mirror of
https://github.com/Sea-Haven-Industries/proposal-system.git
synced 2026-09-30 05:23:14 +00:00
536d440282
Moves proof-or-kill-verified false positives (Fastfile runtime PEM-assembly boilerplate; Podfile.lock CocoaPods SPEC CHECKSUMs) from machine-level to a tracked repo-local .security-review/suppressions.json so the Open SWE daily-report automation resolves them. Justifications sanitized to avoid reproducing the begin-marker literal. Machine-level copy retained until merge.
28 lines
1.6 KiB
JSON
28 lines
1.6 KiB
JSON
{
|
|
"suppressions": [
|
|
{
|
|
"id": "gitleaks-private-key-26",
|
|
"justification": "False positive. mobile/fastlane/Fastfile:26 is Ruby that ASSEMBLES a PEM wrapper (a begin/end private-key marker plus an interpolated base64 body) to normalize an App Store Connect signing key supplied at runtime via CI secret. No key material is committed; the begin-marker literal in source is what trips gitleaks. Known detector-FP pattern. Verified proof-or-kill 2026-07-13."
|
|
},
|
|
{
|
|
"id": "gitleaks-private-key-46",
|
|
"justification": "False positive. mobile/fastlane/Fastfile:46 — same runtime PEM-assembly boilerplate as line 26 (base64->DER->PEM candidate construction). No committed key material."
|
|
},
|
|
{
|
|
"id": "gitleaks-private-key-58",
|
|
"justification": "False positive. mobile/fastlane/Fastfile:58 — same runtime PEM-assembly boilerplate (double-base64->DER->PEM candidate construction). No committed key material."
|
|
},
|
|
{
|
|
"id": "gitleaks-generic-api-key-2243",
|
|
"justification": "False positive. mobile/ios/Podfile.lock:2243 is a CocoaPods SPEC CHECKSUM (a deterministic pod-source integrity hash), not an API key. Podfile.lock checksums are public integrity digests, not secrets."
|
|
},
|
|
{
|
|
"id": "gitleaks-generic-api-key-2319",
|
|
"justification": "False positive. mobile/ios/Podfile.lock:2319 is a CocoaPods SPEC CHECKSUM (pod integrity digest), not an API key."
|
|
},
|
|
{
|
|
"id": "gitleaks-generic-api-key-2445",
|
|
"justification": "False positive. mobile/ios/Podfile.lock:2445 is a CocoaPods SPEC CHECKSUM (pod integrity digest, react-native-keychain pod), not an API key."
|
|
}
|
|
]
|
|
}
|