.gitallowed

# git-secrets allowlist: regexes that should NOT trigger the secret scanner.
#
# Every entry is matched against the scanner's WHOLE "path:line:content"
# output line, and a match exempts that entire line from EVERY detector. So an
# entry must be anchored on the path, the line number and the whole line
# (^path:[0-9]+:...$). A bare token (a placeholder account ID, a keyword) would
# exempt any line that merely contains it, including a real secret next to it
# (#804, #1972). scripts/test-git-secrets-allowlist.sh enforces ^...$ on every
# entry and checks that a secret plus a placeholder on one line is still caught.
#
# DO NOT add a real account ID or secret here. If one lands in the repo, rotate
# it instead of silencing the scanner. Test fixtures should use synthetic
# placeholders; add an entry only for a line a real scan flags.

# scripts/setup-git-secrets.sh registers its detectors as literal regex text,
# and one of them (the Azure connection string) matches its own registration
# line. The DSN detectors used to as well, until #368 widened their schemes to
# alternations, whose registration text no longer spells out a literal
# "scheme://" for the detector to find. The entry below is anchored on the path,
# the line number, AND the entire line as it appears in that file (including
# the trailing comment), with a trailing $ -- not just the "git secrets --add
# '" command prefix, and not just the added pattern with the anchor left open
# at the end. A prefix-only anchor whitelists a secret appended to ANY
# registration line in this file; an anchor missing the trailing $ whitelists
# a secret appended to the END of this specific line. Both are the #1972 hole
# reintroduced at a smaller scale, and both were caught only by a fixture
# exercising exactly that mutation -- add one for any future entry in this
# block that isn't already covered.
#
# The entry also replaces one letter of its own trigger substring with a
# single-character bracket expression, e.g. "Protoco[l]" for "Protocol". This
# is a no-op for matching (as a regex, [l] matches the literal letter l exactly
# like l would) but it breaks the contiguous trigger span the entry is built
# from, so .gitallowed does not need to allow-list ITSELF against the very
# pattern the entry exists to suppress (confirmed empirically: without this,
# the .gitallowed self-scan case fails -- and note this comment must not spell
# that span out literally either, for the same reason).
^scripts/setup-git-secrets\.sh:[0-9]+:add_pattern 'DefaultEndpointsProtoco[l]=https'                      # Azure Connection String$

# Truncated PEM placeholder used by scripts/test-git-secrets-allowlist.sh
# (and by any fixture in this repo needing a non-secret PEM-shaped string):
# a PEM header immediately followed by "\n..." (optionally with a short
# base64 prefix) is never a real key body, so a line consisting of EXACTLY
# a "PrivateKey:" or "private_key" assignment to that shape is safe.
#
# Anchored on the WHOLE scanner output line, not just the quoted value:
# .gitallowed suppresses a line if ANY allowed pattern matches anywhere in
# it, regardless of which prohibited pattern fired, so a real secret in an
# earlier, unrelated statement on the same physical line as this entry's
# fixture would otherwise be suppressed too, even though the entry has
# nothing to do with that secret (a fixture below exercises exactly this:
# a key assigned before the fixture, on the same scanner line, must still
# be caught -- note this comment must not spell the fixture out as a
# literal contiguous string either, for the same self-scan reason).
# ^[^:]+:[0-9]+: pins the match to the start of git-secrets' own
# "path:line:content" format, so the key assignment must be the first thing
# on the line (only leading whitespace allowed), and the trailing $ pins the
# tail to only the closing quote/comma this repo's fixtures actually use.
# Both ends are load-bearing -- do not loosen either back to an open match.
#
# One letter of "PRIVATE" is bracketed for the same self-scan reason the
# block above explains -- do not tidy it back to a bare word.
^[^:]+:[0-9]+:[[:space:]]*("private_key"|PrivateKey):[[:space:]]*"-----BEGIN PRIVAT[E] KEY-----\\n(MIIEvQIBADANBg)?\.\.\.(\\n)?",?$

# Synthetic 12-digit account IDs in test fixtures. The AWS account-ID detector
# flags them. Each entry pins the file kind, the line number pattern and the
# WHOLE line, so a line holding one of these placeholders plus anything else
# (a key, a password) does not match and is still scanned. The last digit of
# each placeholder is bracketed so this file does not match its own entries.
# A single account field per line, quoted placeholder only:
^[^:]+(_test\.go|\.test\.ts):[0-9]+:[[:space:]]*(AccountID|accountID|account_id|Account):[[:space:]]*["'](12345678901[2]|11111111111[1]|11112222333[3]|22222222222[2]|33333333333[3]|44444444444[4]|55555555555[5]|66666666666[6]|77777777777[7]|99988877766[6]|99998888777[7]|99999999999[9])["'],?$
# Test-fixture credential fields: one field, one quoted placeholder from the
# list, nothing else on the line, in a test file only. The values are listed
# rather than matched by shape (#368): a shape such as "any value up to 40
# characters" also passes a real password or a 32-character API key pasted
# into a test file. To use a new placeholder, add it to the list.
^[^:]+(_test\.go|\.test\.ts):[0-9]+:[[:space:]]*password:[[:space:]]*["'](C0mpl3x!S3cur3|lowercases3!|My\$ecur3#S3cur3!|MyAdmin@12345678|MyQwerty123!|NoNumberSecure!|NoSpecialS3cur3|pa111ssword|pass###word|pass1111word|password|password11|password123|S3cure1111xyz!|S3cureAaaa123!|S3cureXyz###1|S3cureXyz11!|SecurePass123!|smtp_password|StrongS3cur3!|testpass|UPPERCASES3!|cGFzc3dvcmQ=)["'],?$
^[^:]+(_test\.go|\.test\.ts):[0-9]+:[[:space:]]*api_key:[[:space:]]*["'](full-api-key-value|full-key-value|new-api-key-12345|test-key)["'],?$

# Placeholder credentials that only the word-bounded detectors (#328) flag:
# a detector glued to a word, e.g. the "password" of db_password or a DSN
# followed by its host name, used to be dropped by git-secrets' grep -w. Each
# line is a test DSN with a dummy user and password, a commented-out example
# value, a docs example, or a Terraform fallback that is literally
# PLACEHOLDER_... text, never a real credential. Same whole-line anchoring and
# bracketing as the block below.
^docs/audits/codebase-audit-2026-09-02\.md:[0-9]+:[[:space:]]*secret_data[[:space:]]+=[[:space:]]+var\.sendgrid_api_ke[y][[:space:]]+!=[[:space:]]+null[[:space:]]+\?[[:space:]]+var\.sendgrid_api_ke[y][[:space:]]+:[[:space:]]+"PLACEHOLDER_REPLACE_ME"[[:space:]]*$
^internal/database/connection_test\.go:[0-9]+:[[:space:]]*poolConfig,[[:space:]]+err[[:space:]]+:=[[:space:]]+pgxpool\.ParseConfig\("postgre[s]://user:pass@127\.0\.0\.1:1/db\?sslmode=disable"\)[[:space:]]*$
^internal/database/postgres/migrations/migrate_dsn_encoding_test\.go:[0-9]+:[[:space:]]*poolCfg,[[:space:]]+err[[:space:]]+:=[[:space:]]+pgxpool\.ParseConfig\("postgre[s]://x:y@db\.example\.com:5433/cudly\?sslmode=require"\)[[:space:]]*$
^internal/database/postgres/migrations/migrate_security_test\.go:[0-9]+:[[:space:]]*rawDSN[[:space:]]+:=[[:space:]]+fmt\.Sprintf\("postgre[s]://user:%s@localhost:5432/db\?sslmode=disable",[[:space:]]+sentinelPassword\)[[:space:]]*$
^internal/database/postgres/migrations/migrate_security_test\.go:[0-9]+:[[:space:]]*rawDSN[[:space:]]+:=[[:space:]]+fmt\.Sprintf\("postgre[s]://user:pass@localhost:5432/db\?sslmode=%s",[[:space:]]+mode\)[[:space:]]*$
^internal/database/postgres/migrations/migrate_security_test\.go:[0-9]+:[[:space:]]*poolCfg,[[:space:]]+err[[:space:]]+:=[[:space:]]+pgxpool\.ParseConfig\("postgre[s]://user:pass@localhost:5432/db\?sslmode=require"\)[[:space:]]*$
^internal/database/postgres/migrations/migrate_security_test\.go:[0-9]+:[[:space:]]*cfg,[[:space:]]+err[[:space:]]+:=[[:space:]]+pgxpool\.ParseConfig\("postgre[s]://user:pass@127\.0\.0\.1:1/db\?sslmode=disable"\)[[:space:]]*$
^terraform/environments/aws/tests/lambda_cors_origins\.tftest\.hcl:[0-9]+:[[:space:]]*defaults[[:space:]]+=[[:space:]]+\{[[:space:]]+account_id[[:space:]]+=[[:space:]]+"123[4]567[8]901[2]"[[:space:]]+\}[[:space:]]*$
^terraform/environments/(aws|azure|gcp)/dev\.tfvars\.example:[0-9]+:[[:space:]]*#[[:space:]]+admin_passwor[d][[:space:]]+=[[:space:]]+"YourSecurePassword123!"[[:space:]]*$
^terraform/modules/secrets/azure/main\.tf:[0-9]+:[[:space:]]*value[[:space:]]+=[[:space:]]+var\.smtp_passwor[d][[:space:]]+!=[[:space:]]+null[[:space:]]+\?[[:space:]]+var\.smtp_passwor[d][[:space:]]+:[[:space:]]+"PLACEHOLDER_GENERATE_IN_AZURE_PORTAL"[[:space:]]*$
^terraform/modules/secrets/gcp/main\.tf:[0-9]+:[[:space:]]*secret_data[[:space:]]+=[[:space:]]+var\.sendgrid_api_ke[y][[:space:]]+!=[[:space:]]+null[[:space:]]+\?[[:space:]]+var\.sendgrid_api_ke[y][[:space:]]+:[[:space:]]+"PLACEHOLDER_REPLACE_ME"[[:space:]]*$
^terraform/profiles/README\.md:[0-9]+:[[:space:]]*export[[:space:]]+TF_VAR_admin_passwor[d]="secret123"[[:space:]]*$
^terraform/profiles/README\.md:[0-9]+:[[:space:]]*admin_passwor[d][[:space:]]+=[[:space:]]+"secret123"[[:space:]]*$
^terraform/environments/aws/tests/postgres_version\.tftest\.hcl:[0-9]+:[[:space:]]*defaults[[:space:]]+=[[:space:]]+\{[[:space:]]+account_id[[:space:]]+=[[:space:]]+"123[4]567[8]901[2]"[[:space:]]+\}[[:space:]]*$

# Lines the DSN detectors flag since #368 added the postgresql://, pgx5:// and
# other schemes. None holds a real credential: the local docker-compose
# database password that docs/DEVELOPMENT.md documents, a ${DB_PASSWORD} shell
# reference in an audit quote, and an audit sentence that names the pgx5 scheme
# in prose, where the detector runs on to a later ":" and "@". Same whole-line
# anchoring as the blocks around it; the scheme is bracketed so this file does
# not match the detector itself.
^docs/DEVELOPMENT\.md:[0-9]+:[[:space:]]*-database[[:space:]]+"pgx[5]://cudly:cudly_local_dev@(localhost|postgres):5432/cudly\?sslmode=disable"[[:space:]]+(up|version|down[[:space:]]+1|\\)[[:space:]]*$
^docs/audits/codebase-audit-2026-09-02\.md:[0-9]+:[[:space:]]*DB_URL="pgx[5]://cudly:\$\{DB_PASSWORD\}@\$\{DB_ENDPOINT\}:5432/cudly\?sslmode=require"[[:space:]]*$
^docs/audits/codebase-audit-2026-09-02\.md:[0-9]+:-[[:space:]]+verdict:[[:space:]]+CONFIRMED[[:space:]]+—[[:space:]]+Dockerfile\.dev:22-33[[:space:]]+downloads[[:space:]]+the[[:space:]]+v4\.17\.0[[:space:]]+release[[:space:]]+tarball,[[:space:]]+while[[:space:]]+Dockerfile:55-85[[:space:]]+explains[[:space:]]+that[[:space:]]+upstream[[:space:]]+tarballs[[:space:]]+carry[[:space:]]+upstream's[[:space:]]+own[[:space:]]+toolchain[[:space:]]+and[[:space:]]+dependency[[:space:]]+pins[[:space:]]+\("how[[:space:]]+issue[[:space:]]+#1833's[[:space:]]+stdlib[[:space:]]+CVEs[[:space:]]+reached[[:space:]]+the[[:space:]]+runtime[[:space:]]+image"\)[[:space:]]+and[[:space:]]+builds[[:space:]]+migrate[[:space:]]+as[[:space:]]+a[[:space:]]+package[[:space:]]+of[[:space:]]+this[[:space:]]+module[[:space:]]+at[[:space:]]+the[[:space:]]+version[[:space:]]+`go\.mod`[[:space:]]+resolves[[:space:]]+\(v4\.19\.1,[[:space:]]+go\.mod:106\)[[:space:]]+with[[:space:]]+`-tags=pgx5`\.[[:space:]]+The[[:space:]]+divergence[[:space:]]+is[[:space:]]+worse[[:space:]]+than[[:space:]]+the[[:space:]]+finding[[:space:]]+states:[[:space:]]+the[[:space:]]+prod[[:space:]]+binary[[:space:]]+registers[[:space:]]+only[[:space:]]+the[[:space:]]+`pgx[5]://`[[:space:]]+scheme[[:space:]]+while[[:space:]]+the[[:space:]]+dev[[:space:]]+tarball[[:space:]]+is[[:space:]]+the[[:space:]]+default[[:space:]]+`postgre[s]://`[[:space:]]+build,[[:space:]]+so[[:space:]]+the[[:space:]]+same[[:space:]]+migration[[:space:]]+command[[:space:]]+is[[:space:]]+not[[:space:]]+portable[[:space:]]+between[[:space:]]+the[[:space:]]+two[[:space:]]+images\.[[:space:]]+`go[[:space:]]+install[[:space:]]+github\.com/air-verse/air@v1\.61\.7`[[:space:]]+at[[:space:]]+Dockerfile\.dev:16[[:space:]]+does[[:space:]]+resolve[[:space:]]+air's[[:space:]]+own[[:space:]]+go\.mod,[[:space:]]+as[[:space:]]+claimed\.[[:space:]]*$

# One-off fixture lines a real scan flags (a synthetic placeholder account ID,
# a throwaway test password, a credential-less test DSN). Each entry pins the
# file, any line number, and the WHOLE line with a trailing $, so appending a
# secret to the line makes it stop matching. One letter or digit of each
# trigger substring is bracketed so this file does not match its own entries.
# Regenerate by scanning with no allowlist and re-deriving the entry from the
# flagged line; if a fixture line changes, its entry stops matching and the
# scan fails loudly.
^docs/audits/codebase-audit-202[6]-09-02\.md:[0-9]+:-[[:space:]]+failure[[:space:]]+scenario:[[:space:]]+A[[:space:]]+session[[:space:]]+whose[[:space:]]+group[[:space:]]+allowed_accounts[[:space:]]+is[[:space:]]+\["Production"\][[:space:]]+calls[[:space:]]+`GET[[:space:]]+/api/dashboard/summary\?account_id=123[4]567[8]901[2]`[[:space:]]+where[[:space:]]+123[4]567[8]901[2][[:space:]]+is[[:space:]]+the[[:space:]]+AWS[[:space:]]+account[[:space:]]+number[[:space:]]+of[[:space:]]+the[[:space:]]+out-of-scope[[:space:]]+"Finance"[[:space:]]+account[[:space:]]+\(or[[:space:]]+`account_ids=<Finance[[:space:]]+UUID>`\)\.[[:space:]]+`resolveSingleAccountFilterIDs`[[:space:]]+\(scoping\.go:277-279\)[[:space:]]+maps[[:space:]]+the[[:space:]]+unknown[[:space:]]+value[[:space:]]+to[[:space:]]+an[[:space:]]+external-id[[:space:]]+filter[[:space:]]+under[[:space:]]+the[[:space:]]+""[[:space:]]+provider[[:space:]]+key,[[:space:]]+the[[:space:]]+non-empty[[:space:]]+result[[:space:]]+skips[[:space:]]+the[[:space:]]+`resolveAllowedAccountScope`[[:space:]]+fallback,[[:space:]]+and[[:space:]]+`calculateCommitmentMetrics`[[:space:]]+->[[:space:]]+`fetchCommitmentPurchases`[[:space:]]+->[[:space:]]+`GetActivePurchaseHistory`[[:space:]]+\(store_postgre[s]\.go:211[2]-211[4],[[:space:]]+`account_id[[:space:]]+=[[:space:]]+ANY\(\.\.\.\)`\)[[:space:]]+aggregates[[:space:]]+Finance's[[:space:]]+rows\.[[:space:]]+The[[:space:]]+response[[:space:]]+returns[[:space:]]+Finance's[[:space:]]+`active_commitments`,[[:space:]]+`committed_monthly`,[[:space:]]+`ytd_savings`[[:space:]]+and[[:space:]]+per-service[[:space:]]+`current_savings`\.[[:space:]]+Only[[:space:]]+the[[:space:]]+recommendations[[:space:]]+half[[:space:]]+is[[:space:]]+scope-filtered[[:space:]]+\(`filterDashboardRecommendations`\);[[:space:]]+the[[:space:]]+purchase-history[[:space:]]+half[[:space:]]+has[[:space:]]+no[[:space:]]+equivalent,[[:space:]]+unlike[[:space:]]+`/api/inventory/\*`[[:space:]]+which[[:space:]]+runs[[:space:]]+`filterPurchaseHistoryByAllowedAccounts`[[:space:]]+after[[:space:]]+the[[:space:]]+same[[:space:]]+fetch[[:space:]]+\(handler_inventory\.go:47,[[:space:]]+197\)[[:space:]]+and[[:space:]]+`/api/history/analytics`[[:space:]]+which[[:space:]]+validates[[:space:]]+the[[:space:]]+requested[[:space:]]+account[[:space:]]+against[[:space:]]+the[[:space:]]+scope[[:space:]]+first[[:space:]]+\(handler_analytics\.go:233-249\)\.[[:space:]]*$
^docs/audits/codebase-audit-202[6]-09-02\.md:[0-9]+:-[[:space:]]+severity-adjusted:[[:space:]]+medium[[:space:]]+—[[:space:]]+`git[[:space:]]+secrets[[:space:]]+--register-aws`[[:space:]]+\(scripts/setup-git-secrets\.sh:43\)[[:space:]]+plus[[:space:]]+the[[:space:]]+pattern[[:space:]]+on[[:space:]]+line[[:space:]]+53[[:space:]]+still[[:space:]]+block[[:space:]]+an[[:space:]]+assignment-shaped[[:space:]]+key[[:space:]]+\(verified:[[:space:]]+`secret_ke[y][[:space:]]+=[[:space:]]+"<40[[:space:]]+chars>"`[[:space:]]+exits[[:space:]]+1\),[[:space:]]+so[[:space:]]+only[[:space:]]+a[[:space:]]+bare[[:space:]]+unassigned[[:space:]]+key[[:space:]]+slips[[:space:]]+through\.[[:space:]]*$
^frontend/src/__tests__/api-apikeys\.test\.ts:[0-9]+:[[:space:]]*const[[:space:]]+request[[:space:]]+=[[:space:]]+\{[[:space:]]+name:[[:space:]]+'New[[:space:]]+Key',[[:space:]]+passwor[d]:[[:space:]]+'cGFzc3dvcmQ=',[[:space:]]+expires_at:[[:space:]]+'202[5]-12-31T00:00:00Z'[[:space:]]+\};[[:space:]]*$
^internal/analytics/collector_test\.go:[0-9]+:[[:space:]]*AccountID:[[:space:]]+"123[4]567[8]901[2]",[[:space:]]+Timestamp:[[:space:]]+time\.Now\(\)\.AddDate\(-3,[[:space:]]+0,[[:space:]]+0\),[[:space:]]*$
^internal/api/exchange_helpers_test\.go:[0-9]+:[[:space:]]*"account_id":[[:space:]]+"111[1]111[1]-111[1]-111[1]-111[1]-111[1]111[1]111[1]",[[:space:]]*$
^internal/api/handler_accounts_test\.go:[0-9]+:[[:space:]]*AccountID:[[:space:]]+"111[1]111[1]-111[1]-111[1]-111[1]-111[1]111[1]111[1]",[[:space:]]*$
^internal/api/handler_accounts_test\.go:[0-9]+:[[:space:]]*_,[[:space:]]+err[[:space:]]+:=[[:space:]]+handler\.discoverOrgAccounts\(ctx,[[:space:]]+adminRequest\(`\{"account_id":"111[1]111[1]-111[1]-111[1]-111[1]-111[1]111[1]111[1]"\}`\)\)[[:space:]]*$
^internal/api/handler_dashboard_test\.go:[0-9]+:[[:space:]]*\{AccountID:[[:space:]]+"999[9]888[8]777[7]",[[:space:]]+Timestamp:[[:space:]]+purchaseTime,[[:space:]]+Term:[[:space:]]+1,[[:space:]]+EstimatedSavings:[[:space:]]+175\.0\},[[:space:]]*$
^internal/api/handler_dashboard_test\.go:[0-9]+://[[:space:]]+account_id=111[1]222[2]333[3][[:space:]]+\(the[[:space:]]+external[[:space:]]+number,[[:space:]]+not[[:space:]]+the[[:space:]]+UUID\)\.[[:space:]]+The[[:space:]]+fix[[:space:]]+must[[:space:]]*$
^internal/api/handler_federation_test\.go:[0-9]+:[[:space:]]*return[[:space:]]+&sourceIdentity\{Provider:[[:space:]]+"aws",[[:space:]]+AccountID:[[:space:]]+"123[4]567[8]901[2]"\}[[:space:]]*$
^internal/api/handler_history_test\.go:[0-9]+:[[:space:]]*\{AccountID:[[:space:]]+"123[4]567[8]901[2]",[[:space:]]+PurchaseID:[[:space:]]+"purchase-1",[[:space:]]+UpfrontCost:[[:space:]]+new\(float64\(100\.0\)\),[[:space:]]+EstimatedSavings:[[:space:]]+10\.0\},[[:space:]]*$
^internal/api/handler_history_test\.go:[0-9]+:[[:space:]]*"account_id":[[:space:]]+"123[4]567[8]901[2]",[[:space:]]*$
^internal/api/handler_history_test\.go:[0-9]+:[[:space:]]*\{AccountID:[[:space:]]+"111[1]111[1]111[1]",[[:space:]]+PurchaseID:[[:space:]]+"purchase-1",[[:space:]]+UpfrontCost:[[:space:]]+new\(float64\(100\.0\)\),[[:space:]]+EstimatedSavings:[[:space:]]+10\.0\},[[:space:]]*$
^internal/api/handler_history_test\.go:[0-9]+:[[:space:]]*\{AccountID:[[:space:]]+"222[2]222[2]222[2]",[[:space:]]+PurchaseID:[[:space:]]+"purchase-2",[[:space:]]+UpfrontCost:[[:space:]]+new\(float64\(200\.0\)\),[[:space:]]+EstimatedSavings:[[:space:]]+20\.0\},[[:space:]]*$
^internal/api/handler_history_test\.go:[0-9]+:[[:space:]]*_,[[:space:]]+err[[:space:]]+:=[[:space:]]+handler\.getHistory\(ctx,[[:space:]]+req,[[:space:]]+map\[string\]string\{"provider":[[:space:]]+"aws",[[:space:]]+"account_id":[[:space:]]+"123[4]567[8]901[2]"\}\)[[:space:]]*$
^internal/api/handler_history_test\.go:[0-9]+:[[:space:]]*Return\(\[\]config\.PurchaseHistoryRecord\{\{AccountID:[[:space:]]+"123[4]567[8]901[2]",[[:space:]]+PurchaseID:[[:space:]]+"p-legacy"\}\},[[:space:]]+nil\)\.Once\(\)[[:space:]]*$
^internal/api/handler_history_test\.go:[0-9]+:[[:space:]]*_,[[:space:]]+err[[:space:]]+:=[[:space:]]+handler\.getHistory\(ctx,[[:space:]]+req,[[:space:]]+map\[string\]string\{"account_id":[[:space:]]+"123[4]567[8]901[2]"\}\)[[:space:]]*$
^internal/api/handler_purchases_revoke_constraints_test\.go:[0-9]+:[[:space:]]*rec\.AccountID[[:space:]]+=[[:space:]]+"123[4]567[8]901[2]"[[:space:]]*$
^internal/api/handler_ri_exchange_test\.go:[0-9]+:[[:space:]]*QueryStringParameters:[[:space:]]+map\[string\]string\{"account_id":[[:space:]]+"123[4]567[8]901[2]"\},[[:space:]]*$
^internal/auth/carveout_wildcard_test\.go:[0-9]+:[[:space:]]*const[[:space:]]+passwor[d][[:space:]]+=[[:space:]]+"CorrectHorse@123"[[:space:]]*$
^internal/auth/service_lockout_test\.go:[0-9]+:[[:space:]]*\{name:[[:space:]]+"locked",[[:space:]]+attempts:[[:space:]]+5,[[:space:]]+lockOffset:[[:space:]]+time\.Minute,[[:space:]]+passwor[d]:[[:space:]]+"CorrectPassword123"\},[[:space:]]*$
^internal/auth/service_lockout_test\.go:[0-9]+:[[:space:]]*\{name:[[:space:]]+"expired[[:space:]]+success",[[:space:]]+attempts:[[:space:]]+5,[[:space:]]+lockOffset:[[:space:]]+-time\.Minute,[[:space:]]+passwor[d]:[[:space:]]+"CorrectPassword123",[[:space:]]+method:[[:space:]]+"RecordSuccessfulLogin"\},[[:space:]]*$
^internal/auth/service_lockout_test\.go:[0-9]+:[[:space:]]*\{name:[[:space:]]+"reset[[:space:]]+on[[:space:]]+success",[[:space:]]+attempts:[[:space:]]+3,[[:space:]]+passwor[d]:[[:space:]]+"CorrectPassword123",[[:space:]]+method:[[:space:]]+"RecordSuccessfulLogin"\},[[:space:]]*$
^internal/auth/service_lockout_test\.go:[0-9]+:[[:space:]]*\{name:[[:space:]]+"MFA[[:space:]]+failure",[[:space:]]+attempts:[[:space:]]+4,[[:space:]]+passwor[d]:[[:space:]]+"CorrectPassword123",[[:space:]]+mfa:[[:space:]]+true,[[:space:]]+method:[[:space:]]+"RecordFailedLogin"\},[[:space:]]*$
^internal/auth/service_lockout_test\.go:[0-9]+:[[:space:]]*\{name:[[:space:]]+"success[[:space:]]+write",[[:space:]]+passwor[d]:[[:space:]]+"CorrectPassword123",[[:space:]]+method:[[:space:]]+"RecordSuccessfulLogin"\},[[:space:]]*$
^internal/auth/service_lockout_test\.go:[0-9]+:[[:space:]]*\{name:[[:space:]]+"session[[:space:]]+creation",[[:space:]]+passwor[d]:[[:space:]]+"CorrectPassword123",[[:space:]]+sessionError:[[:space:]]+true\},[[:space:]]*$
^internal/auth/service_login_db_test\.go:[0-9]+:[[:space:]]*passwor[d][[:space:]]+=[[:space:]]+"OriginalPassword123!"[[:space:]]*$
^internal/auth/service_password_test\.go:[0-9]+:[[:space:]]*passwor[d]:[[:space:]]+"VeryLongS3cur3!"[[:space:]]+\+[[:space:]]+string\(make\(\[\]byte,[[:space:]]+120\)\),[[:space:]]*$
^internal/config/store_postgres_history_validate_test\.go:[0-9]+:[[:space:]]*err[[:space:]]+:=[[:space:]]+store\.SavePurchaseHistory\(context\.Background\(\),[[:space:]]+&PurchaseHistoryRecord\{AccountID:[[:space:]]+"123[4]567[8]901[2]",[[:space:]]+PurchaseID:[[:space:]]+id,[[:space:]]+Provider:[[:space:]]+"aws"\}\)[[:space:]]*$
^internal/config/store_postgres_pgxmock_test\.go:[0-9]+:[[:space:]]*//[[:space:]]+The[[:space:]]+matched[[:space:]]+row[[:space:]]+has[[:space:]]+account_id="999[9]888[8]777[7]"[[:space:]]+and[[:space:]]+cloud_account_id[[:space:]]+NULL[[:space:]]*$
^internal/config/store_postgres_ri_exchange_reservation_integration_test\.go:[0-9]+:[[:space:]]*boundaryRow[[:space:]]+:=[[:space:]]+&RIExchangeRecord\{AccountID:[[:space:]]+"444[4]444[4]444[4]",[[:space:]]+Region:[[:space:]]+"us-east-1",[[:space:]]+SourceRIIDs:[[:space:]]+\[\]string\{"ri-boundary"\},[[:space:]]*$
^internal/config/store_postgres_ri_exchange_reservation_integration_test\.go:[0-9]+:[[:space:]]*third[[:space:]]+:=[[:space:]]+&RIExchangeRecord\{AccountID:[[:space:]]+"333[3]333[3]333[3]",[[:space:]]+Region:[[:space:]]+"ap-south-1",[[:space:]]+SourceRIIDs:[[:space:]]+\[\]string\{"ri-C"\},[[:space:]]*$
^internal/config/store_postgres_ri_exchange_reservation_integration_test\.go:[0-9]+:[[:space:]]*probe[[:space:]]+:=[[:space:]]+&RIExchangeRecord\{AccountID:[[:space:]]+"777[7]777[7]777[7]",[[:space:]]+Region:[[:space:]]+"us-west-2",[[:space:]]+SourceRIIDs:[[:space:]]+\[\]string\{"ri-lock-probe"\},[[:space:]]*$
^internal/credentials/resolver_test\.go:[0-9]+:[[:space:]]*AWSResolveOptions\{AmbientProvider:[[:space:]]+testAmbientCreds,[[:space:]]+AmbientSTS:[[:space:]]+&callerIdentitySTS\{account:[[:space:]]+"111[1]111[1]111[1]"\}\},[[:space:]]*$
^internal/credentials/resolver_test\.go:[0-9]+:[[:space:]]*"different[[:space:]]+host[[:space:]]+account":[[:space:]]+\{"222[2]222[2]222[2]",[[:space:]]+&callerIdentitySTS\{account:[[:space:]]+"111[1]111[1]111[1]"\}\},[[:space:]]*$
^internal/credentials/resolver_test\.go:[0-9]+:[[:space:]]*"empty[[:space:]]+external_id":[[:space:]]+\{"",[[:space:]]+&callerIdentitySTS\{account:[[:space:]]+"111[1]111[1]111[1]"\}\},[[:space:]]*$
^internal/database/config_test\.go:[0-9]+:[[:space:]]*assert\.Contains\(t,[[:space:]]+cfg\.DSN\(`back\\slash`\),[[:space:]]+`[[:space:]]+passwor[d]='back\\\\slash'[[:space:]]+`\)[[:space:]]*$
^internal/database/postgres/migrations/000[0]78_monthly_summary_nested_rollup_test\.go:[0-9]+:[[:space:]]*const[[:space:]]+account[[:space:]]+=[[:space:]]+"123[4]567[8]901[2]"[[:space:]]*$
^internal/database/postgres/migrations/migrate_cancel_integration_test\.go:[0-9]+:[[:space:]]*adminDSN[[:space:]]+=[[:space:]]+fmt\.Sprintf\("postgre[s]://cudly_test:test_passwor[d]@%s:%d/cudly_test\?sslmode=disable",[[:space:]]+c\.Config\.Host,[[:space:]]+c\.Config\.Port\)[[:space:]]*$
^internal/database/postgres/migrations/migrate_cancel_test\.go:[0-9]+:[[:space:]]*cfg,[[:space:]]+err[[:space:]]+:=[[:space:]]+pgxpool\.ParseConfig\("postgre[s]://u:p@"[[:space:]]+\+[[:space:]]+ln\.Addr\(\)\.String\(\)[[:space:]]+\+[[:space:]]+"/db\?sslmode=disable"\)[[:space:]]*$
^internal/email/coverage_test\.go:[0-9]+:[[:space:]]*passwor[d]:[[:space:]]+"onlypass",[[:space:]]+//[[:space:]]+Only[[:space:]]+passwor[d][[:space:]]+-[[:space:]]+auth[[:space:]]+should[[:space:]]+not[[:space:]]+be[[:space:]]+created[[:space:]]*$
^internal/scheduler/recommendation_completeness_integration_test\.go:[0-9]+:[[:space:]]*s[[:space:]]+:=[[:space:]]+&Scheduler\{config:[[:space:]]+store,[[:space:]]+providerFactory:[[:space:]]+factory,[[:space:]]+stsClient:[[:space:]]+&fakeSTSClient\{accountID:[[:space:]]+"111[1]111[1]111[1]"\}\}[[:space:]]*$
^internal/scheduler/scheduler_test\.go:[0-9]+:[[:space:]]*stsClient:[[:space:]]+&fakeSTSClient\{accountID:[[:space:]]+"111[1]111[1]111[1]"\},[[:space:]]*$
^internal/scheduler/scheduler_test\.go:[0-9]+:[[:space:]]*"different[[:space:]]+host[[:space:]]+account":[[:space:]]+&fakeSTSClient\{accountID:[[:space:]]+"999[9]999[9]999[9]"\},[[:space:]]*$
^internal/scheduler/scheduler_test\.go:[0-9]+:[[:space:]]*stsClient:[[:space:]]+&fakeSTSClient\{accountID:[[:space:]]+"123[4]567[8]901[2]"\},[[:space:]]*$
^internal/scheduler/scheduler_test\.go:[0-9]+:[[:space:]]*stsClient:[[:space:]]+&fakeSTSClient\{accountID:[[:space:]]+"999[8]887[7]766[6]"\},[[:space:]]*$
^internal/scheduler/zonal_recs_test\.go:[0-9]+:[[:space:]]*s[[:space:]]+:=[[:space:]]+&Scheduler\{providerFactory:[[:space:]]+factory,[[:space:]]+stsClient:[[:space:]]+&fakeSTSClient\{accountID:[[:space:]]+"111[1]111[1]111[1]"\}\}[[:space:]]*$
^internal/scheduler/zonal_recs_test\.go:[0-9]+:[[:space:]]*s[[:space:]]+:=[[:space:]]+&Scheduler\{config:[[:space:]]+new\(MockConfigStore\),[[:space:]]+providerFactory:[[:space:]]+factory,[[:space:]]+stsClient:[[:space:]]+&fakeSTSClient\{accountID:[[:space:]]+"111[1]111[1]111[1]"\}\}[[:space:]]*$
^internal/server/adapter_test\.go:[0-9]+:[[:space:]]*const[[:space:]]+passwor[d][[:space:]]+=[[:space:]]+"CorrectHorse@123"[[:space:]]*$
^internal/server/commitment_probe_config_test\.go:[0-9]+:[[:space:]]*build[[:space:]]+:=[[:space:]]+newCommitmentProbeConfigBuilder\(nil,[[:space:]]+aws\.AnonymousCredentials\{\},[[:space:]]+hostIdentitySTS\{account:[[:space:]]+"111[1]111[1]111[1]"\}\)[[:space:]]*$
^internal/server/handler_ladder_test\.go:[0-9]+:[[:space:]]*Scope:[[:space:]]+pkgladder\.Scope\{Provider:[[:space:]]+pkgcommon\.ProviderAWS,[[:space:]]+AccountID:[[:space:]]+"123[4]567[8]901[2]"\},[[:space:]]*$
^internal/server/handler_ri_exchange_reservation_integration_test\.go:[0-9]+:[[:space:]]*accountID:[[:space:]]+"555[5]555[5]555[5]",[[:space:]]+region:[[:space:]]+"us-east-1",[[:space:]]*$
^internal/server/handler_ri_exchange_reservation_integration_test\.go:[0-9]+:[[:space:]]*AccountID:[[:space:]]+"666[6]666[6]666[6]",[[:space:]]+Region:[[:space:]]+"eu-west-1",[[:space:]]+LadderRunID:[[:space:]]+&ladderRunID,[[:space:]]*$
^internal/server/ladder_write_test\.go:[0-9]+:[[:space:]]*accountID[[:space:]]+=[[:space:]]+"123[4]567[8]901[2]"[[:space:]]*$
^internal/server/migrations_bounded_real_runner_test\.go:[0-9]+:[[:space:]]*cfg,[[:space:]]+err[[:space:]]+:=[[:space:]]+pgxpool\.ParseConfig\("postgre[s]://u:p@"[[:space:]]+\+[[:space:]]+ln\.Addr\(\)\.String\(\)[[:space:]]+\+[[:space:]]+"/db\?sslmode=disable"\)[[:space:]]*$
^scripts/generate-federation-iac_test\.go:[0-9]+:[[:space:]]*`aws_account_id[[:space:]]+=[[:space:]]+"111[1]222[2]333[3]"`,[[:space:]]*$
^scripts/generate-federation-iac_test\.go:[0-9]+:[[:space:]]*accountID:[[:space:]]+"000[0]111[1]222[2]",[[:space:]]*$
^terraform/environments/aws/tests/fargate_cdn_alb\.tftest\.hcl:[0-9]+:[[:space:]]*account_id[[:space:]]+=[[:space:]]+"123[4]567[8]901[2]"[[:space:]]*$

# The bare AWS secret access key detector (#295) flags this line, which holds no
# secret: an IAM OIDC thumbprint (a public certificate hash, upper-case hex) in a
# validation test. Same whole-line anchoring as above. One character in the middle
# of the flagged run is bracketed, so this file does not match the detector itself.
^internal/api/handler_federation_test\.go:[0-9]+:[[:space:]]*\{"990F4193972F2BEC[F]12DDEDA5237F9C952F20D9E",[[:space:]]+"uppercase[[:space:]]+hex"\},[[:space:]]*$