# Allowlisted gitleaks findings, one fingerprint per line
# (commit:path:rule:line). Add an entry only after confirming by hand that the
# match is not a real credential.
#
# generic-api-key false positives in an old plan doc: a sentence there labels a
# Tailwind utility-class list (the border-neutral / bg-neutral variants) with a
# word the rule treats as a secret name. The value is CSS classes, not a secret.
1bb3963d0e14615c596cedd8197b35f355760f01:docs/superpowers/plans/2026-03-18-captures-workspace-redesign.md:generic-api-key:496
231407378302b4754fc678b6f4204235be716bef:docs/superpowers/plans/2026-03-18-captures-workspace-redesign.md:generic-api-key:496
e110997ac02e43a5d988737180b5c137bcfddbd0:docs/superpowers/plans/2026-03-18-captures-workspace-redesign.md:generic-api-key:496
0b3ce694524a4c28a65e38aef0c23f4e29274354:docs/superpowers/plans/2026-03-18-captures-workspace-redesign.md:generic-api-key:496
30da1bf581814128fdaee92e7488349ef7b84660:docs/superpowers/plans/2026-03-18-captures-workspace-redesign.md:generic-api-key:496
#
# A prior version of this file quoted that same string in a comment, which
# re-tripped the rule. Suppress the historical commit that introduced it.
19b1b589587a6d158a15518b854f035e1de92ab9:.gitleaksignore:generic-api-key:6
#
# generic-api-key false positives in the checked-in design-handoff prototype:
# the demo "signals" fixture data includes a fake session-token string (an
# nj_-prefixed hex value) alongside a fake bitcoin address. Mock content, not
# a credential.
8cfca5b66727ad124917257a639d0ccdf453a036:docs/design-handoff/2026-08-10-birdbrain-prototype/style_sync_patch/prototypes/Case Reviewer.dc.html:generic-api-key:434
8cfca5b66727ad124917257a639d0ccdf453a036:docs/design-handoff/2026-08-10-birdbrain-prototype/Case Reviewer.dc.html:generic-api-key:434
8cfca5b66727ad124917257a639d0ccdf453a036:docs/design-handoff/2026-08-10-birdbrain-prototype/Birdbrain.dc.html:generic-api-key:5620
#
# The same fixture line re-tripped once more when the bundle was restored to
# its as-received state after an automated review tool edited it.
2edc1b790edcd5e8ae79e43738c33f85ff4c0187:docs/design-handoff/2026-08-10-birdbrain-prototype/Case Reviewer.dc.html:generic-api-key:434
#
# The same mock fixture data appears in an earlier commit that used a different
# path prefix (design_handoff_birdbrain_prototype/ with underscores rather than
# docs/design-handoff/...). Same content, not a real credential.
7be984ea6955fc030a167d5de61064b83d1613bd:design_handoff_birdbrain_prototype/Case Reviewer.dc.html:generic-api-key:434
7be984ea6955fc030a167d5de61064b83d1613bd:design_handoff_birdbrain_prototype/style_sync_patch/prototypes/Case Reviewer.dc.html:generic-api-key:434
7be984ea6955fc030a167d5de61064b83d1613bd:design_handoff_birdbrain_prototype/style_sync_patch/prototypes/Birdbrain.dc.html:generic-api-key:5727
7be984ea6955fc030a167d5de61064b83d1613bd:design_handoff_birdbrain_prototype/Birdbrain.dc.html:generic-api-key:5727
#
# The 2026-08-21 standalone mock carries the same fake fixture line as the V1
# bundle above: an nj_-prefixed session token on a mocked phishing page, beside
# a fake card-collection form and a fake bitcoin address. The file ships packed,
# so the whole template is one line and the rule reports it at line 384. Mock
# page content, not a credential. Two commits carry it: the squashed merge of
# #703 and the pre-merge commit on its branch.
a447ef03d1ed557433f5c36a1bfdb03d99dd926e:docs/design-handoff/2026-08-21-birdbrain-standalone/Birdbrain-standalone.html:generic-api-key:384
8496383ab885be6e1444273135f760a7e260a06a:docs/design-handoff/2026-08-21-birdbrain-standalone/Birdbrain-standalone.html:generic-api-key:384
#
# The #398 frozen pre-scope fixture package: a known-answer verification
# fixture whose manifest carries a synthetic RFC 3161 timestamp token pointing
# at tsa.example.com. Deliberately fabricated test data, not a credential.
# The squash merge to main will re-introduce the same line and need its own
# fingerprint entry, per the standalone-mock precedent above.
cd5a25c266ba99b515ddaeb39c16a05ce954080b:tests/shared/verify/fixtures/pre-scope-package/manifest.jsonl:generic-api-key:3
#
# The squash merge of #838 re-introduced the pre-scope fixture manifest at a
# new sha, as the block above predicted. Same synthetic tsaToken, same line,
# not a credential. The branch entry above is inert now that the source
# branch is deleted, and stays for history.
911859d698f1b66c9993e9fe617b4fc0f74bf4ad:tests/shared/verify/fixtures/pre-scope-package/manifest.jsonl:generic-api-key:3
#
# The 2026-09-14 design-project export copied the same mock "Session token:
# nj_..." fixture line into multiple archived prototype files. This is demo
# content from the design handoff bundle (same fake token pattern as earlier
# allowlists), not a real credential.
89085808dd8b8d411ff9ac822511e17f605b7797:docs/design-handoff/2026-09-14-design-project-export/Birdbrain v2 (github sync) copy.dc.html:generic-api-key:863
89085808dd8b8d411ff9ac822511e17f605b7797:docs/design-handoff/2026-09-14-design-project-export/Birdbrain v2 (github sync).dc.html:generic-api-key:863
89085808dd8b8d411ff9ac822511e17f605b7797:docs/design-handoff/2026-09-14-design-project-export/Birdbrain v2.dc.html:generic-api-key:477
89085808dd8b8d411ff9ac822511e17f605b7797:docs/design-handoff/2026-09-14-design-project-export/Birdbrain-standalone.html:generic-api-key:384
89085808dd8b8d411ff9ac822511e17f605b7797:docs/design-handoff/2026-09-14-design-project-export/Birdbrain.html:generic-api-key:384
89085808dd8b8d411ff9ac822511e17f605b7797:docs/design-handoff/2026-09-14-design-project-export/Case Reviewer.dc.html:generic-api-key:434
89085808dd8b8d411ff9ac822511e17f605b7797:docs/design-handoff/2026-09-14-design-project-export/archive/Birdbrain - Fable.dc.html:generic-api-key:4619
89085808dd8b8d411ff9ac822511e17f605b7797:docs/design-handoff/2026-09-14-design-project-export/archive/Birdbrain - Opus.dc.html:generic-api-key:4619
89085808dd8b8d411ff9ac822511e17f605b7797:docs/design-handoff/2026-09-14-design-project-export/archive/Birdbrain -pre-standardization 2026-08-08-.dc.html:generic-api-key:4913
89085808dd8b8d411ff9ac822511e17f605b7797:docs/design-handoff/2026-09-14-design-project-export/design_handoff_birdbrain_prototype/Birdbrain.dc.html:generic-api-key:6171
89085808dd8b8d411ff9ac822511e17f605b7797:docs/design-handoff/2026-09-14-design-project-export/design_handoff_birdbrain_prototype/Case Reviewer.dc.html:generic-api-key:434
89085808dd8b8d411ff9ac822511e17f605b7797:docs/design-handoff/2026-09-14-design-project-export/design_handoff_birdbrain_prototype/style_sync_patch/prototypes/Birdbrain.dc.html:generic-api-key:5727
89085808dd8b8d411ff9ac822511e17f605b7797:docs/design-handoff/2026-09-14-design-project-export/design_handoff_birdbrain_prototype/style_sync_patch/prototypes/Case Reviewer.dc.html:generic-api-key:434
89085808dd8b8d411ff9ac822511e17f605b7797:docs/design-handoff/2026-09-14-design-project-export/design_handoff_style_sync/prototypes/Birdbrain.dc.html:generic-api-key:5727
89085808dd8b8d411ff9ac822511e17f605b7797:docs/design-handoff/2026-09-14-design-project-export/design_handoff_style_sync/prototypes/Case Reviewer.dc.html:generic-api-key:434
fc4a365e1be2cc7f7b4134e4084ae97c47c5cc68:docs/design-handoff/2026-09-14-birdbrain-dc/Birdbrain.dc.html:generic-api-key:6211
#
# #1474 (commit 6ed0204d) edited the 2026-08-21 standalone mock, so the same
# packed fixture line surfaced once more at that commit. Same mock session
# token as the a447ef03 and 8496383a entries for this file, not a credential.
6ed0204df9a4c00a123fe54f3685f69d27e71f94:docs/design-handoff/2026-08-21-birdbrain-standalone/Birdbrain-standalone.html:generic-api-key:384
#
# #1657 (PR #1664, commit 66ec73bf): a known-answer test pins the SHA-256
# fingerprint of the demo fixture's public signing key, in a constant whose name
# the rule treats as a secret name. The value is a digest of a public key,
# confirmed by hand against the fixture's archive header, not a credential. A
# later commit on the branch renamed the constant so the squash merge does not
# match the rule again.
66ec73bfcabfdcf8ea031c561af5e309a0c7b0b1:tests/main/services/importedCasePackage.test.ts:generic-api-key:72
#
# generic-api-key false positive in the case investigation design mock: the
# line is sample page text for a fictional phishing kit ("Session token:
# nj_..."), invented for the mock. It is not a real credential.
8f8832e004d9a8202f6eb411b9c12b6fc7adb2a2:docs/design-handoff/2026-10-04-case-investigation-view/Birdbrain.dc.html:generic-api-key:7223
#
# The revised case investigation bundle (PR #1762) carries the same fictional
# "Session token: nj_..." page text, a mock value, not a credential.
6d84fd822296ddd3e2f979bdecf08246a9945468:docs/design-handoff/2026-10-06-case-investigation-view/Birdbrain.dc.html:generic-api-key:7343
#
# The squash merge of PR #1762 onto main re-tripped the same mock line.
6edd186bb6f828660cf947ce189041f31ed3429c:docs/design-handoff/2026-10-06-case-investigation-view/Birdbrain.dc.html:generic-api-key:7343