.gitleaks.toml

# Custom gitleaks config for wazuh-mcp.
# Extends the default rules with Wazuh-specific patterns.

title = "wazuh-mcp gitleaks config"

[extend]
useDefault = true

# Wazuh-specific patterns
[[rules]]
id = "wazuh-api-jwt"
description = "Wazuh JWT-style API token in source"
regex = '''wazuh[_-]?api[_-]?token\s*[:=]\s*["']?eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+'''

[[rules]]
id = "keycloak-client-secret-literal"
description = "Keycloak client_secret in URL or env"
regex = '''client_secret\s*[:=]\s*["']?[A-Za-z0-9_-]{32,}'''

[[rules]]
id = "wazuh-manager-password"
description = "Wazuh manager API password literal"
# Non-capturing trigger keyword + capturing password group so secretGroup=1
# points the allowlist at the password value (not the trigger). Prior shape
# captured the trigger word itself, which broke allowlist regex matching.
regex = '''(?:server_api_password|wazuh-wui|wazuh_manager_password)\s*[:=]\s*["']?([A-Za-z0-9!@#$%^&*]{12,})'''
secretGroup = 1

# Allowlist for known-safe test-fixture credentials.
#
# Two scopes layered into one [allowlist] block:
#
# 1. Source-tree test creds — hardcoded passwords used by the docker-compose
#    dev fixtures, the integration test suite, and documentation examples.
#    These are NOT real credentials; they are documented as such in
#    docker/README.md and tests/integration/conftest.py.
#
# 2. Integration-log artifacts — Vault dev-mode prints a fresh unseal key
#    per startup; Keycloak demo realm issues test-user JWTs. Both leak into
#    compose.log (uploaded as a CI artifact for debugging).
[allowlist]
description = "Test-fixture creds in source + transient artifacts in integration logs"
regexes = [
  # Wazuh manager test password (wazuh-wui:MCPmcp12345!) used across
  # docker/integration-compose.yml, docker/multi-manager-compose.yml,
  # docker/bootstrap.sh, docker/seed_alerts.py, tests/integration/conftest.py,
  # and docs that show the curl-with-creds pattern. Documented non-secret.
  '''MCPmcp12345!''',
  # Per-tenant test secrets used by the integration fixtures.
  '''test-client-secret(?:-tenant-b)?''',
  '''alicepw''',
  '''bobpw''',
  # Vault dev-mode prints a fresh random unseal key + the literal
  # 'test-root-token' on every startup. Both leak into compose.log.
  '''Unseal Key:\s+[A-Za-z0-9+/=]{40,}''',
  '''Root Token:\s+test-root-token''',
  # Keycloak demo realm tokens visible in compose logs (issued for
  # the test user; expire in 5min, no reuse value).
  '''eyJhbGciOi[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+''',
  # Hex test fingerprints used in pivot-by-ioc test cases (eval corpus,
  # tests/unit, docs). Not credentials.
  '''deadbeefcafebabe''',
  # OpenSearch demo admin creds in docker compose healthcheck commands.
  # Not real credentials; OpenSearch ships these as the dev-mode default.
  '''admin:admin''',
  # OpenSearch securityadmin default password (admin:SecretPassword) used
  # by the wazuh-indexer healthcheck before the per-deploy admin password
  # is rotated in. Demo / bootstrap-only.
  '''admin:SecretPassword''',
]
paths = [
  # Test certificates auto-generated by the wazuh-certs-generator container.
  # Real deployments mount their own cert bundle; these only exist in the
  # CI/dev fixture path.
  '''docker/config/wazuh_indexer_ssl_certs/.*\.(pem|key)''',
]