From b5ebb21b05e89bc9c63603a6c3f74050d45ec6bc Mon Sep 17 00:00:00 2001
From: Aric Camarata <aric.camarata@gmail.com>
Date: Wed, 1 Jul 2026 18:26:39 -0400
Subject: [PATCH 1/2] fix(security): repair gitleaks config to prevent scanner
 panic
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The .gitleaks.toml here was copied from a shared template with two
structural bugs that crash gitleaks 8.30 config loading before any
scan runs, failing the secrets job on every PR:

1. [allowlist.commits] was a nested TOML table, but gitleaks expects
   AllowList.Commits as a flat string array. Decoding it as a map
   crashes with "expected type 'string', got unconvertible type 'map'".
   Fixed by moving `commits = []` to a flat key inside [allowlist].

2. Several `paths` entries used glob syntax (`**/*.test.ts`,
   `.github/wiki/**`, etc.) but gitleaks paths are Go regexes, not
   globs — glob syntax panics at config load ("missing argument to
   repetition operator"). Replaced with equivalent valid regexes.

Also adds a shape-based allowlist regex for `process.env.X` /
`import.meta.env.X` references, which the hasura-admin-secret rule
was flagging as false positives (14 files reference
process.env.HASURA_GRAPHQL_ADMIN_SECRET as a variable, not a literal
secret).

Same structural fix already applied in ummeco/ummat PR #84 and
ummeco/praycalc PR #52.
---
 .gitleaks.toml | 35 +++++++++++++++++++++--------------
 1 file changed, 21 insertions(+), 14 deletions(-)

diff --git a/.gitleaks.toml b/.gitleaks.toml
index 3c13eb5..5fab51f 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -116,24 +116,31 @@ regexes = [
   '''(?i)(example|placeholder|your[_-]?key[_-]?here|changeme|replace[_-]?me|REPLACE_WITH|test[_-]?secret)''',
   '''(?i)#\s*(example|see|ref|link|note|todo):''',
   '''HASURA_GRAPHQL_ADMIN_SECRET=.*\$\{''',
+  # ── Shape-based FP suppression (matched against the captured secret) ──
+  # Go RE2 has no lookahead, so the rules can't exclude these in-regex.
+  # JS/TS env references: process.env.X / process.env['X'] / import.meta.env.X
+  # — this repo's hasura-admin-secret rule captures the RHS of
+  # `const HASURA_ADMIN_SECRET = process.env.HASURA_GRAPHQL_ADMIN_SECRET`,
+  # which is a variable reference, not a literal secret value.
+  '''(?i)^(process|import\.meta)\.env[.\[_]''',
 ]
+# NOTE: gitleaks `commits` must be a flat array key inside [allowlist], not a
+# nested [allowlist.commits] table — a nested table crashes gitleaks 8.30 config
+# decoding ("expected type 'string', got unconvertible type 'map'").
+commits = []
+# NOTE: gitleaks `paths` entries are Go REGEXES, not globs. Glob syntax like
+# "**/*.test.ts" is an invalid regex ("missing argument to repetition operator")
+# and makes gitleaks PANIC at config load — failing the secrets job on every PR
+# before any scan runs. Keep every entry valid regex.
 paths = [
-  ".env.example",
-  ".env.template",
-  ".env.sample",
+  '''\.env\.(example|template|sample)$''',
   '''\.next/''',
   '''\.dart_tool/''',
   '''node_modules/''',
-  '''.*\.test\.(ts|tsx)$''',
+  '''.*\.(test|spec)\.(ts|tsx)$''',
   '''.*fixtures?/.*''',
-  "**/*.test.ts",
-  "**/*.spec.ts",
-  "**/__tests__/**",
-  ".github/docs/**",
-  ".github/wiki/**",
-  "pnpm-lock.yaml",
-  ".gitleaks.toml",
+  '''.*__tests__/.*''',
+  '''\.github/(docs|wiki)/.*''',
+  '''pnpm-lock\.yaml$''',
+  '''\.gitleaks\.toml$''',
 ]
-
-[allowlist.commits]
-commits = []

From adea2ed93821346f3dd5c4eccfb12a595a04e762 Mon Sep 17 00:00:00 2001
From: Aric Camarata <aric.camarata@gmail.com>
Date: Wed, 1 Jul 2026 18:43:21 -0400
Subject: [PATCH 2/2] fix(security): suppress false-positive gitleaks history
 finding

README env-template block spilled HASURA_ADMIN_URL (a URL, not a
secret) into the hasura-admin-secret capture group via history scan.
---
 .gitleaks.toml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.gitleaks.toml b/.gitleaks.toml
index 5fab51f..1df4c7a 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -123,6 +123,10 @@ regexes = [
   # `const HASURA_ADMIN_SECRET = process.env.HASURA_GRAPHQL_ADMIN_SECRET`,
   # which is a variable reference, not a literal secret value.
   '''(?i)^(process|import\.meta)\.env[.\[_]''',
+  # README .env template block: HASURA_GRAPHQL_ADMIN_SECRET= is left blank
+  # (no value), and the multi-line regex spills into the next line's
+  # HASURA_ADMIN_URL=https://... — that's a URL, not a secret literal.
+  '''(?i)^HASURA_ADMIN_URL=https?://''',
 ]
 # NOTE: gitleaks `commits` must be a flat array key inside [allowlist], not a
 # nested [allowlist.commits] table — a nested table crashes gitleaks 8.30 config