title = "gitleaks config for Lotus Chat (cinny fork)"

# Gitea #95 — secret scanning was entirely absent. Extend gitleaks' built-in
# ruleset (don't replace it) and allowlist the known-public infrastructure
# URLs that show up in tracked config, which are hostnames, not secrets.
[extend]
useDefault = true

[allowlist]
description = "Known-public Lotus/Matrix homeserver + npm registry URLs — not secrets"
regexes = [
  '''https?://matrix\.lotusguild\.org''',
  '''https?://code\.lotusguild\.org/api/packages/LotusGuild/npm/''',
  '''matrix\.lotusguild\.org''',
]
paths = [
  '''config\.json''',
  '''\.npmrc''',
]