From 5a0793bd356f56f37ff260703c26942adfaf8fd7 Mon Sep 17 00:00:00 2001 From: Adam Moussa Date: Mon, 29 Jun 2026 12:14:49 -0400 Subject: [PATCH] chore: suppress test-fixture credential false positive in token-TTL tests Add a machine-level suppression for the fake "ghp_secret" GitHub token used by the cached-token TTL/revocation unit tests (CWE-798). Not a real credential and not a valid PAT; scoped to the unit test only. --- .security-review/suppressions.json | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.security-review/suppressions.json b/.security-review/suppressions.json index 9e754dcb..47ed2662 100644 --- a/.security-review/suppressions.json +++ b/.security-review/suppressions.json @@ -45,6 +45,19 @@ "suppression_justification": "Test fixture, not a real credential. Same fake Datadog API key \"secret-api-1234\" passed into connect_datadog by test_datadog_roundtrip_and_redaction. Never a live secret; scoped to the unit test only.", "owner": "adam@seahavenind.com", "added": "2026-06-29" + }, + { + "id": "gitleaks-generic-api-key-23", + "title": "Hardcoded credential flagged in GitHub-token TTL test fixture (CWE-798)", + "file": "tests/test_github_token_ttl.py", + "line": 23, + "rule": "CWE-798", + "severity": "high", + "status": "false-positive", + "justification": "Test fixture, not a real credential. The literal \"ghp_secret\" is a fake GitHub token used by the cached-token TTL/revocation unit tests to exercise cache_github_token_for_thread / get_github_token expiry and invalidation. It is not a valid 40-char GitHub PAT, is never a live secret, and is scoped to the unit test only. Pre-existing test fixture, not introduced by this change.", + "suppression_justification": "Test fixture, not a real credential. The literal \"ghp_secret\" is a fake GitHub token used by the cached-token TTL/revocation unit tests to exercise cache_github_token_for_thread / get_github_token expiry and invalidation. It is not a valid 40-char GitHub PAT, is never a live secret, and is scoped to the unit test only. Pre-existing test fixture, not introduced by this change.", + "owner": "adam@seahavenind.com", + "added": "2026-06-29" } ] }