# detect-secrets configuration
# https://github.com/Yelp/detect-secrets

[detect-secrets]
version = 1.4.0

# Plugins to use for scanning
plugins_used:
  - name: AWSKeyDetector
  - name: AzureStorageKeyDetector
  - name: BasicAuthDetector
  - name: CloudantDetector
  - name: DiscordBotTokenDetector
  - name: GitHubTokenDetector
  # detect-secrets v1.4.x uses separate high-entropy plugins for base64/hex
  - name: Base64HighEntropyString
    limit: 4.5
  - name: HexHighEntropyString
    limit: 3.0
  - name: IbmCloudIamDetector
  - name: IbmCosHmacDetector
  - name: JwtTokenDetector
  - name: MailchimpDetector
  - name: NpmDetector
  - name: PrivateKeyDetector
  - name: SendGridDetector
  - name: SlackDetector
  - name: SoftlayerDetector
  - name: SquareOAuthDetector
  - name: StripeDetector
  - name: TwilioKeyDetector

# Exclude patterns
exclude_lines:
  - "^\\s*#"
  - "example.com"
  - "your-api-key"
  - "<token>"
  - "(?i)<your.*>"
  - "sk-xxx"

# Exclude files
exclude_files:
  - ".*\\.secrets\\.baseline$"
  - ".*\\.lock$"
  - ".*\\.min\\.js$"
  - ".*\\.(png|jpg|gif|ico|svg|woff2?)$"
  - "^REFERENCE/"
  - "^tests/"
  - "^web/tests/"
  - "^tests/fixtures/"