.gitleaksignore

# gitleaks ignore list — fingerprints reviewed and confirmed false positive.
# Format: <commit-sha>:<file-path>:<rule-id>:<line>
#
# 3b25385 used the literal string "Bearer cp_lx_REDACTED_TOKEN" as a doc
# placeholder for the autoblog webhook example. The cp_lx_ prefix tripped
# the curl-auth-header rule. Replaced with "<secret-key>" in 394ee87 — the
# current tree is clean — but the historical blob still matches, so pin it
# here rather than force-push master.

3b253859e66d682d38537375b0e61f41e7ebb977:app/(marketing)/docs/autoblog-webhook/page.tsx:curl-auth-header:130

# 64a7711 ships a fake "pk_test_..." publishable key inside a sample <script>
# tag fixture for the tracker integration analyzer test. Not a real secret —
# it's asserted on by the test, so pin the historical blob rather than rewrite.
64a771186801871e191fb913b801b086d9ef3235:tests/contract/tracker-integrations.test.ts:generic-api-key:8

# A fingerprint pins one commit, and both lines above survived edits to their
# files, so the same non-secret matches again under every later SHA that still
# carries the line. These are the remaining occurrences of the two entries
# above — same lines, same verdict, later commits.
#
# 2eb14f9b: the same pk_test_ fixture.
2eb14f9b73d3100d207b41ea23d216ee2100acc9:tests/contract/tracker-integrations.test.ts:generic-api-key:8
# 508859ed: the same curl example, by then reading `-H "Authorization: Bearer
# $SECRET"` — a shell variable the reader substitutes, not a token.
508859ed12ff73cd5044a4fd10971372779578cb:app/(marketing)/docs/autoblog-webhook/page.tsx:curl-auth-header:130

# Purging .env.bak-2026-07-28 from history (e3d0f63 -> 5a51ce2) rewrote every
# commit from 2026-07-28 onward; earlier commits kept their SHAs, so the four
# fingerprints above still resolve. What changed is the later commit that also
# carries the pk_test_ fixture line — it has a new SHA and needs its own entry.
b7360e66a22d02cf8c002ee9347240176b66dcea:tests/contract/tracker-integrations.test.ts:generic-api-key:8