Fix gitleaks generic-api-key false positive (Plan 00087) - #37
Merged
Conversation
…ngines.md CI's gitleaks secret scan pins 8.30.1, whose default ruleset flags Medium/byteiota (a slash-joined citation to two blog names) as generic-api-key. Reproduced with the exact CI binary version, confirmed 8.21.2 does not catch it (ruleset drift, not a repo regression). Rephrased rather than growing .gitleaks.toml's allowlist. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Independent review returned PASS WITH NITS: the fix, the rephrase-over- allowlist call, and CI-green were all confirmed correct, but the plan's README.md index row was missing. Added under Active Plans. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
LTSCommerce
added a commit
that referenced
this pull request
Aug 24, 2026
…ix so both PRs share a clean base # Conflicts: # CLAUDE/Plan/README.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
F44'sgitleaks secret scanCI check has been red for a while, unrelated to anyin-flight PR's own diff — confirmed the same failure exists on F44's own tip. One
finding:
generic-api-keyonMedium/byteiotainCLAUDE/Plan/Completed/00070-lightweight-agent-browser-engine/research/scan-alt-engines.md:222— a citation to two blog names joined by
/, not a credential.Root cause confirmed with the exact CI gitleaks version: CI pins
8.30.1(
.github/workflows/qa.yml); downloading and running that exact binary reproduces thefinding immediately.
8.30.1's default ruleset added coverage that catches thisslash-joined, mixed-case shape — an older
8.21.2binary does NOT flag it, confirmingthis is upstream ruleset drift, not a repo regression.
Fix
Rephrased
Medium/byteiota→Medium (Byteiota)— removes the token shape gitleaks'generic-api-keyrule keys on. Deliberately NOT adding another.gitleaks.tomlallowlist entry: the repo's own anti-pattern doctrine flags "an allowlist that grows"
as a smell, and a prose citation has no reason to be a single slash-joined token in the
first place.
Test plan
against the file before the fix
git archive HEAD | tar -xto export the exact tracked tree at this commit(matching a real
actions/checkout, not a dirty working tree with gitignoredlocal state), then
gitleaks dir . --redact --no-banner --verbose(8.30.1) —0 leaks across the whole tree
🤖 Generated with Claude Code