security-scan gate (shared felhom.eu/scripts/security_scan_gate.py) in the fast set and CI, warn-first, with the accepted-hits file and decoys (R-986)

2026-10-19 21:11:31 +02:00
parent c4b3b0a039
commit a03c25aa1f
5 changed files with 56 additions and 0 deletions
@@ -0,0 +1,7 @@
+# .security-accepted — hits security_scan_gate.py (felhom.eu/scripts, R-986) lists as ACCEPTED, not WARN.
+# One per line: <tool> <id> <where>  # reason. govulncheck: OSV id + module dir; gitleaks: rule@<sha256[:12] of the line> + file.
+# The first scan's verdicts (2026-10-19): felhom.eu documentation/audits/night-2026-10-19/P7/triage.md
+gitleaks generic-api-key@93610586e88d controller/internal/stacks/samba_test.go  # false: a test constant or a decoy value, no live secret
+gitleaks generic-api-key@a882b8f2ea6b controller/internal/backup/offbox_offer_shapec_r241_test.go  # false: a test constant or a decoy value, no live secret
+gitleaks generic-api-key@b3c473a524c2 controller/scripts/test_gate_decoys.py  # false: a test constant or a decoy value, no live secret
+gitleaks generic-api-key@c9c6aa2fcae6 controller/scripts/test_gate_decoys.py  # false: a test constant or a decoy value, no live secret