# gitleaks false-positive baseline (created by agent-workflows).
#
# gitleaks ignores findings by FINGERPRINT, printed in its report as:
#   <commit-sha>:<file-path>:<rule-id>:<line-number>
# Paste a confirmed false positive's fingerprint on its own line to suppress it.
# Do NOT suppress a real secret: rotate it, then purge it from history.
#
# This baseline starts empty. Example (commented out):
# 0a1b2c3d4e5f6a7b8c9d:tests/fixtures/sample.env:generic-api-key:12

# Confirmed false positives: synthetic AWS-key-shaped strings in tests/test_ocman.py that
# exercise ocman's own secret-detection/redaction feature (e.g. "Here is my aws token
# AKIA... on this line"). These are NOT live credentials; there is nothing to rotate.
6985a1b9ed51f35650220a8dc41b7eb3f07a046e:tests/test_ocman.py:aws-access-token:2630
6985a1b9ed51f35650220a8dc41b7eb3f07a046e:tests/test_ocman.py:aws-access-token:2684
63b35e559a8195e25457a53017695a8155f9874d:tests/test_ocman.py:aws-access-token:2182
63b35e559a8195e25457a53017695a8155f9874d:tests/test_ocman.py:aws-access-token:2187
63b35e559a8195e25457a53017695a8155f9874d:tests/test_ocman.py:aws-access-token:2208
63b35e559a8195e25457a53017695a8155f9874d:tests/test_ocman.py:aws-access-token:2211

# Same synthetic AWS fixture strings, echoed into a PRIOR release-review run's own
# artifacts (findings register / report) while documenting the secret-scan finding.
# Run records under workflow-artifacts/ are out of review scope; not live credentials.
2040732d7680af37da1fe4c7ee84e1290aee7b74:workflow-artifacts/release-review/20260720-125929/03-findings-register.csv:aws-access-token:3
039951c4b9d80f9618222da3a86295b60fcf1385:workflow-artifacts/release-review/20260720-125929/12-final-response.md:aws-access-token:21
2040732d7680af37da1fe4c7ee84e1290aee7b74:workflow-artifacts/release-review/20260720-125929/section-summaries/02-quality-security-edge-cases.md:aws-access-token:31
