# Allowlisted gitleaks findings, one fingerprint per line
# (commit:path:rule:line). Add an entry only after confirming by hand that the
# match is not a real credential.
#
# generic-api-key false positives in an old plan doc: a sentence there labels a
# Tailwind utility-class list (the border-neutral / bg-neutral variants) with a
# word the rule treats as a secret name. The value is CSS classes, not a secret.
1bb3963d0e14615c596cedd8197b35f355760f01:docs/superpowers/plans/2026-03-18-captures-workspace-redesign.md:generic-api-key:496
231407378302b4754fc678b6f4204235be716bef:docs/superpowers/plans/2026-03-18-captures-workspace-redesign.md:generic-api-key:496
e110997ac02e43a5d988737180b5c137bcfddbd0:docs/superpowers/plans/2026-03-18-captures-workspace-redesign.md:generic-api-key:496
0b3ce694524a4c28a65e38aef0c23f4e29274354:docs/superpowers/plans/2026-03-18-captures-workspace-redesign.md:generic-api-key:496
30da1bf581814128fdaee92e7488349ef7b84660:docs/superpowers/plans/2026-03-18-captures-workspace-redesign.md:generic-api-key:496
#
# A prior version of this file quoted that same string in a comment, which
# re-tripped the rule. Suppress the historical commit that introduced it.
19b1b589587a6d158a15518b854f035e1de92ab9:.gitleaksignore:generic-api-key:6
#
# generic-api-key false positives in the checked-in design-handoff prototype:
# the demo "signals" fixture data includes a fake session-token string (an
# nj_-prefixed hex value) alongside a fake bitcoin address. Mock content, not
# a credential.
8cfca5b66727ad124917257a639d0ccdf453a036:docs/design-handoff/2026-08-10-birdbrain-prototype/style_sync_patch/prototypes/Case Reviewer.dc.html:generic-api-key:434
8cfca5b66727ad124917257a639d0ccdf453a036:docs/design-handoff/2026-08-10-birdbrain-prototype/Case Reviewer.dc.html:generic-api-key:434
8cfca5b66727ad124917257a639d0ccdf453a036:docs/design-handoff/2026-08-10-birdbrain-prototype/Birdbrain.dc.html:generic-api-key:5620
#
# The same fixture line re-tripped once more when the bundle was restored to
# its as-received state after an automated review tool edited it.
2edc1b790edcd5e8ae79e43738c33f85ff4c0187:docs/design-handoff/2026-08-10-birdbrain-prototype/Case Reviewer.dc.html:generic-api-key:434
#
# The same mock fixture data appears in an earlier commit that used a different
# path prefix (design_handoff_birdbrain_prototype/ with underscores rather than
# docs/design-handoff/...). Same content, not a real credential.
7be984ea6955fc030a167d5de61064b83d1613bd:design_handoff_birdbrain_prototype/Case Reviewer.dc.html:generic-api-key:434
7be984ea6955fc030a167d5de61064b83d1613bd:design_handoff_birdbrain_prototype/style_sync_patch/prototypes/Case Reviewer.dc.html:generic-api-key:434
7be984ea6955fc030a167d5de61064b83d1613bd:design_handoff_birdbrain_prototype/style_sync_patch/prototypes/Birdbrain.dc.html:generic-api-key:5727
7be984ea6955fc030a167d5de61064b83d1613bd:design_handoff_birdbrain_prototype/Birdbrain.dc.html:generic-api-key:5727
#
# The 2026-08-21 standalone mock carries the same fake fixture line as the V1
# bundle above: an nj_-prefixed session token on a mocked phishing page, beside
# a fake card-collection form and a fake bitcoin address. The file ships packed,
# so the whole template is one line and the rule reports it at line 384. Mock
# page content, not a credential. Two commits carry it: the squashed merge of
# #703 and the pre-merge commit on its branch.
a447ef03d1ed557433f5c36a1bfdb03d99dd926e:docs/design-handoff/2026-08-21-birdbrain-standalone/Birdbrain-standalone.html:generic-api-key:384
8496383ab885be6e1444273135f760a7e260a06a:docs/design-handoff/2026-08-21-birdbrain-standalone/Birdbrain-standalone.html:generic-api-key:384
#
# The #398 frozen pre-scope fixture package: a known-answer verification
# fixture whose manifest carries a synthetic RFC 3161 timestamp token pointing
# at tsa.example.com. Deliberately fabricated test data, not a credential.
# The squash merge to main will re-introduce the same line and need its own
# fingerprint entry, per the standalone-mock precedent above.
cd5a25c266ba99b515ddaeb39c16a05ce954080b:tests/shared/verify/fixtures/pre-scope-package/manifest.jsonl:generic-api-key:3
#
# The squash merge of #838 re-introduced the pre-scope fixture manifest at a
# new sha, as the block above predicted. Same synthetic tsaToken, same line,
# not a credential. The branch entry above is inert now that the source
# branch is deleted, and stays for history.
911859d698f1b66c9993e9fe617b4fc0f74bf4ad:tests/shared/verify/fixtures/pre-scope-package/manifest.jsonl:generic-api-key:3