# gitleaks allowlist.
#
# Every entry below is a confirmed false positive, affirmed individually
# during the repository's publication audit on 2026-08-23 (gitleaks 8.30.1).
#
# The first three are all the same string: a Python standard-library module
# name (the `pygram` submodule of `lib2to3`) appearing inside a hard-coded
# list of stdlib module names, next to its `pgen2.tokenize` sibling.
# gitleaks' generic-api-key rule flags it on Shannon entropy alone (3.807),
# with no credential-shaped context anywhere near it. It is not a secret and
# there is nothing to rotate.
#
# The fingerprints are commit-scoped, so they were generated after the
# git-filter-repo mailmap pass that rewrote every commit SHA. If history is
# ever rewritten again, re-run gitleaks and refresh these lines.

8e2b34fb1095b8c11c25835772746d069bbb3e69:veny.py:generic-api-key:486
29b95077d93d63f5db4d430801e0fb5b80d39d27:mypy.py:generic-api-key:476
380df7d401ceb83b77e9458329a80970ed6af02f:mypy.py:generic-api-key:447

# The fourth entry is this file flagging itself. The first version of this
# allowlist (commit 5722027) quoted the offending module names verbatim while
# explaining them, which gitleaks then detected as a fourth leak -- in the
# very file written to silence the first three. The comment above no longer
# spells the pair out, so nothing new triggers it, but that first commit's
# blob is immutable and a history scan still reaches it.

5722027ccf6ffb07f8c784af41fe19f57c94a2b3:.gitleaksignore:generic-api-key:9
