fix(gitleaks): uppercase allowlist condition AND (Bugbot)

[LukasWodka]

Finding

Bugbot (from backend#1404, Medium severity): the gitleaks allowlist condition field in .gitleaks.toml (line 9) was set to lowercase "and".

Gitleaks parses this field case-sensitively and only recognizes uppercase AND / OR. A lowercase value is not matched, so gitleaks silently falls back to the default OR condition. That means the allowlist matched on targetRules OR paths OR regexes instead of requiring all criteria to match together — the intended AND was dropped, causing the allowlist to over-match.

Fix

Change condition = "and" to condition = "AND" so the allowlist requires all criteria (targetRules AND paths AND regexes) as intended.

Confirmation that uppercase is correct

Verified against the gitleaks config documentation (gitleaks README): the condition field values are uppercase — "OR" (default) and "AND". Quote: the default condition is "OR", and "AND" "can be used to make sure all criteria match." Lowercase values are not recognized.

🤖 Generated with Claude Code

---

Note

Low Risk
Single config-token change in .gitleaks.toml; tightens secret-scan allowlist behavior with no runtime or auth impact.

Overview
Fixes gitleaks allowlist logic for the synthetic idempotency-key exception in submit tests.

In .gitleaks.toml, the allowlist condition is changed from lowercase "and" to "AND". Gitleaks treats that field case-sensitively; unrecognized values fall back to OR, so the rule was matching when any of targetRules, paths, or regexes matched instead of requiring all three. With AND, the allowlist only applies when the generic-api-key rule, _test.go path, and the nightly-claims idempotency-key pattern all match together.

^{Reviewed by Cursor Bugbot for commit ae46277. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

FR on staging → Ready for prod (staging FR sweep, 2026-08-06). Basis: CI/tooling-only change with no product runtime surface — verified green through code review + Bugbot on develop and the fr-gated staging promotion. No product-behavior verification required for this class.