{"$schema":"http://json-schema.org/draft-07/schema#","$id":"https://json.schemastore.org/gitleaks.json","x-tombi-toml-version":"v1.0.0","title":"Gitleaks configuration","description":"Configuration for Gitleaks secret detection rules and allowlists.\nhttps://github.com/gitleaks/gitleaks#configuration","type":"object","additionalProperties":false,"not":{"description":"[allowlist] is deprecated and cannot be used alongside [[allowlists]].","required":["allowlist","allowlists"],"properties":{"allowlist":{},"allowlists":{}}},"properties":{"$schema":{"description":"Optional schema URL for editor integrations.","type":"string"},"title":{"description":"Configuration title.","type":"string"},"description":{"description":"Configuration description.","type":"string"},"minVersion":{"description":"Minimum Gitleaks version required to use this configuration.","type":"string"},"extend":{"$ref":"#/definitions/extend"},"rules":{"description":"Detection rules.","type":"array","items":{"$ref":"#/definitions/rule"}},"allowlist":{"$ref":"#/definitions/globalAllowlist","description":"Deprecated global allowlist form. Prefer [[allowlists]]."},"allowlists":{"description":"Global or targeted allowlists.","type":"array","items":{"$ref":"#/definitions/globalAllowlist"}}},"definitions":{"extend":{"description":"Configuration inheritance options.","type":"object","additionalProperties":false,"not":{"description":"useDefault and path cannot be used at the same time.","required":["path","useDefault"],"properties":{"path":{},"useDefault":{"const":true}}},"properties":{"path":{"description":"Path to a configuration file to extend.","type":"string"},"url":{"description":"URL to a configuration file to extend.","type":"string"},"useDefault":{"description":"Extend the default Gitleaks configuration.","type":"boolean"},"disabledRules":{"$ref":"#/definitions/stringArray","description":"Inherited rule IDs to disable."}}},"rule":{"description":"A detection rule.","type":"object","additionalProperties":false,"not":{"description":"[rules.allowlist] is deprecated and cannot be used alongside [[rules.allowlists]].","required":["allowlist","allowlists"],"properties":{"allowlist":{},"allowlists":{}}},"required":["id"],"properties":{"id":{"description":"Unique rule identifier.","type":"string","minLength":1},"description":{"description":"Human-readable rule description.","type":"string"},"regex":{"description":"Go regular expression used to detect secrets.","type":"string"},"secretGroup":{"description":"Regex capture group used as the secret and for entropy checks.","type":"integer","minimum":0},"entropy":{"description":"Minimum Shannon entropy required for the configured secret group.","type":"number","minimum":0},"path":{"description":"Go regular expression used to match paths.","type":"string"},"keywords":{"$ref":"#/definitions/stringArray","description":"Keywords used for pre-regex filtering."},"tags":{"$ref":"#/definitions/stringArray","description":"Metadata tags."},"skipReport":{"description":"Do not include this rule in reports.","type":"boolean"},"allowlist":{"$ref":"#/definitions/ruleAllowlist","description":"Deprecated rule allowlist form. Prefer [[rules.allowlists]]."},"allowlists":{"description":"Rule-specific allowlists.","type":"array","items":{"$ref":"#/definitions/ruleAllowlist"}},"required":{"description":"Auxiliary rules required for a composite rule match.","type":"array","items":{"$ref":"#/definitions/requiredRule"}}}},"requiredRule":{"type":"object","additionalProperties":false,"required":["id"],"properties":{"id":{"description":"Required rule ID.","type":"string","minLength":1},"withinLines":{"description":"Maximum line distance between the primary finding and required finding.","type":"integer","minimum":0},"withinColumns":{"description":"Maximum column distance between the primary finding and required finding.","type":"integer","minimum":0}}},"globalAllowlist":{"description":"A global or targeted allowlist for commits, paths, regexes, or stopwords.","type":"object","additionalProperties":false,"anyOf":[{"required":["commits"],"properties":{"commits":{"$ref":"#/definitions/stringArray"}}},{"required":["paths"],"properties":{"paths":{"$ref":"#/definitions/stringArray"}}},{"required":["regexes"],"properties":{"regexes":{"$ref":"#/definitions/stringArray"}}},{"required":["stopwords"],"properties":{"stopwords":{"$ref":"#/definitions/stringArray"}}}],"properties":{"targetRules":{"$ref":"#/definitions/stringArray","description":"Rule IDs this common allowlist applies to."},"description":{"description":"Human-readable allowlist description.","type":"string"},"condition":{"description":"Whether any criterion or all criteria must match.","type":"string","enum":["AND","OR","and","or","&&","||"]},"commits":{"$ref":"#/definitions/stringArray","description":"Commit SHAs to allow."},"paths":{"$ref":"#/definitions/stringArray","description":"Path regular expressions to allow."},"regexTarget":{"description":"Finding field tested by regexes.","type":"string","enum":["secret","match","line"]},"regexes":{"$ref":"#/definitions/stringArray","description":"Content regular expressions to allow."},"stopwords":{"$ref":"#/definitions/stringArray","description":"Stopwords matched against the extracted secret."}}},"ruleAllowlist":{"description":"An allowlist for commits, paths, regexes, or stopwords.","type":"object","additionalProperties":false,"anyOf":[{"required":["commits"],"properties":{"commits":{"$ref":"#/definitions/stringArray"}}},{"required":["paths"],"properties":{"paths":{"$ref":"#/definitions/stringArray"}}},{"required":["regexes"],"properties":{"regexes":{"$ref":"#/definitions/stringArray"}}},{"required":["stopwords"],"properties":{"stopwords":{"$ref":"#/definitions/stringArray"}}}],"properties":{"description":{"description":"Human-readable allowlist description.","type":"string"},"condition":{"description":"Whether any criterion or all criteria must match.","type":"string","enum":["AND","OR","and","or","&&","||"]},"commits":{"$ref":"#/definitions/stringArray","description":"Commit SHAs to allow."},"paths":{"$ref":"#/definitions/stringArray","description":"Path regular expressions to allow."},"regexTarget":{"description":"Finding field tested by regexes.","type":"string","enum":["secret","match","line"]},"regexes":{"$ref":"#/definitions/stringArray","description":"Content regular expressions to allow."},"stopwords":{"$ref":"#/definitions/stringArray","description":"Stopwords matched against the extracted secret."}}},"stringArray":{"type":"array","items":{"type":"string"}}}}