proposal-system/.security-review/suppressions.json

{
  "suppressions": [
    {
      "id": "gitleaks-private-key-26",
      "justification": "False positive. mobile/fastlane/Fastfile:26 is Ruby that ASSEMBLES a PEM wrapper (a begin/end private-key marker plus an interpolated base64 body) to normalize an App Store Connect signing key supplied at runtime via CI secret. No key material is committed; the begin-marker literal in source is what trips gitleaks. Known detector-FP pattern. Verified proof-or-kill 2026-07-13."
    },
    {
      "id": "gitleaks-private-key-46",
      "justification": "False positive. mobile/fastlane/Fastfile:46 — same runtime PEM-assembly boilerplate as line 26 (base64->DER->PEM candidate construction). No committed key material."
    },
    {
      "id": "gitleaks-private-key-58",
      "justification": "False positive. mobile/fastlane/Fastfile:58 — same runtime PEM-assembly boilerplate (double-base64->DER->PEM candidate construction). No committed key material."
    },
    {
      "id": "gitleaks-generic-api-key-2243",
      "justification": "False positive. mobile/ios/Podfile.lock:2243 is a CocoaPods SPEC CHECKSUM (a deterministic pod-source integrity hash), not an API key. Podfile.lock checksums are public integrity digests, not secrets."
    },
    {
      "id": "gitleaks-generic-api-key-2319",
      "justification": "False positive. mobile/ios/Podfile.lock:2319 is a CocoaPods SPEC CHECKSUM (pod integrity digest), not an API key."
    },
    {
      "id": "gitleaks-generic-api-key-2445",
      "justification": "False positive. mobile/ios/Podfile.lock:2445 is a CocoaPods SPEC CHECKSUM (pod integrity digest, react-native-keychain pod), not an API key."
    }
  ]
}