From ec47d542dd02bdaec50a6df941d1ae178249b9e8 Mon Sep 17 00:00:00 2001 From: Lotus CI Date: Mon, 19 Oct 2026 04:24:51 -0400 Subject: [PATCH] ci(gitleaks): allowlist the desktop updater minisign public key utils/updateErrors.ts embeds the public key that verifies Linux downloads (cinny-desktop #36); gitleaks' generic-api-key rule matched it. It is a published public key, not a secret. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5 --- .gitleaks.toml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.gitleaks.toml b/.gitleaks.toml index 4b2c445c1..606887140 100644 --- a/.gitleaks.toml +++ b/.gitleaks.toml @@ -12,6 +12,9 @@ regexes = [ '''https?://matrix\.lotusguild\.org''', '''https?://code\.lotusguild\.org/api/packages/LotusGuild/npm/''', '''matrix\.lotusguild\.org''', + # Lotus Chat desktop updater's minisign PUBLIC key (published in the + # cinny-desktop README); utils/updateErrors.ts verifies Linux downloads with it. + '''RWRZZdyii05/NUcz337A5SAbiZK\+NPVDWuiL2mM5Jk1p/LfRmNfiZ/6l''', ] paths = [ '''config\.json''',