# Trivy secret scanner config — fine-grained allow rules.
# See https://trivy.dev/docs/scanner/secret/#configuration

allow-rules:
  # The throwaway EC key used for local-dev ID token signing, in
  # config/local.yaml and the dev quickstart overlay in docker/local-setup/.
  # Allowlisted by its exact content, with no `path`: Trivy skips every file a
  # `path` rule matches, so a path would let any other secret in those files
  # through. A different key, in any file, is still caught.
  - id: local-dev-id-signing-key
    description: "Throwaway local-dev EC signing key (not a real secret)"
    regex: MHcCAQEEIBG7o\+PPPIdPqMK4RwNWnj