From c4c0225820404d1396bfc0e446e398a61b01c701 Mon Sep 17 00:00:00 2001 From: Scott Hall Date: Sun, 26 Jul 2026 15:31:53 -0500 Subject: [PATCH] chore(security): gitignore the leak-scanner token file The real customer/vendor token list is created by an operator before the tooling that consumes it exists. Without this rule the file sits un-ignored in the working tree and is stageable by `git add -A`, which is precisely the exposure the file exists to prevent. Ignoring the path up front costs nothing. --- .gitignore | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.gitignore b/.gitignore index a94ae5d..da4eb67 100644 --- a/.gitignore +++ b/.gitignore @@ -100,3 +100,11 @@ Thumbs.db /*.html /*.txt /*.yml + +# The real customer/vendor token list consumed by scripts/security/scan_forbidden.py at +# commit time. Only the SYNTHETIC scan-tokens.local.txt.example is ever committed. +# +# Deliberately unconditional, and listed ahead of the scanner it serves: an operator creates +# this file before the tooling that references it exists, so ignoring the path up front +# removes any window in which a real token list sits un-ignored in a working tree. +scripts/security/scan-tokens.local.txt