.gitleaks.toml

# Gitleaks configuration for Hermes SEG
# https://github.com/gitleaks/gitleaks

title = "Hermes SEG Secret Detection"

[extend]
# Use the default gitleaks config as base
useDefault = true

# Custom rules for Hermes-specific secrets

# Catches: password = EXAMPLE_REDACTED_PW (Dovecot, Postfix mysql-*.cf)
# Catches: password    = EXAMPLE_REDACTED_PW (Postfix mysql-aliases.cf tab-indented)
# NOTE: never paste a real secret here as an "example" -- gitleaks does not scan
# its own config, so anything real placed in this file is invisible to the scan.
# Catches: password = "quoted_value" (LDAP configs, general)
# Does NOT flag: password = hermes_db_password (template placeholders)
# Does NOT flag: password = $variable or password = ${ENV_VAR}
# Does NOT flag: password = PASSWORD / PASS_WORD / YOUR_PASSWORD (documentation placeholders)
[[rules]]
id = "hermes-password-bare"
description = "Bare or quoted password in config files"
regex = '''(?i)password\s*=\s*['"]?[a-zA-Z0-9!@#$%^&*()]{8,}['"]?'''
secretGroup = 0
entropy = 3.0
keywords = ["password"]
[rules.allowlist]
regexes = [
    # Template placeholders (hermes_db_password, hermes_ldap_password, etc.)
    '''(?i)password\s*=\s*['"]?hermes_''',
    # Documentation/example placeholders
    '''(?i)password\s*=\s*['"]?PASSWORD['"]?''',
    '''(?i)password\s*=\s*['"]?PASS_WORD['"]?''',
    '''(?i)password\s*=\s*['"]?YOUR_PASSWORD['"]?''',
    '''(?i)password\s*=\s*['"]?CHANGE_ME''',
    # CFML variable-to-variable assignment: the NC Mail profile credential is
    # handed over as a variable, never a literal.
    #   <cfset ncMailPassword = mintedAppPasswordPlain>
    # Named explicitly rather than shape-matched, so renaming the variable
    # re-trips the rule and forces a fresh look. Set by
    # inc/mint_system_app_password.cfm.
    '''(?i)password\s*=\s*mintedAppPasswordPlain''',
    '''(?i)password\s*=\s*['"]?password['"]?''',
    # Variable references (shell, CFML, Perl)
    '''(?i)password\s*=\s*['"]?\$''',
    '''(?i)password\s*=\s*['"]?#''',
    # Hashed passwords (argon2, bcrypt, sha, ssha)
    '''(?i)password\s*=\s*['"]?\{''',
    '''(?i)password\s*=\s*['"]?\$argon2''',
    '''(?i)password\s*=\s*['"]?\$2[aby]\$'''
]

# Catches: MYSQL_PASSWORD=value, DB_PASSWORD=value in env files and scripts
[[rules]]
id = "hermes-env-database-password"
description = "Database password in environment variable"
regex = '''(?i)(MYSQL_PASSWORD|DB_PASSWORD|DATABASE_PASSWORD|MARIADB_PASSWORD|MARIADB_ROOT_PASSWORD)\s*=\s*['"]?[a-zA-Z0-9!@#$%^&*()]{8,}['"]?'''
secretGroup = 0
entropy = 3.0
keywords = ["MYSQL_PASSWORD", "DB_PASSWORD", "DATABASE_PASSWORD", "MARIADB_PASSWORD", "MARIADB_ROOT_PASSWORD"]
[rules.allowlist]
regexes = [
    '''(?i)=\s*['"]?CHANGE_ME''',
    '''(?i)=\s*['"]?YOUR_''',
    '''(?i)=\s*['"]?\$\{''',
    '''(?i)=\s*['"]?\$[A-Z]'''
]

# Catches: DBI connection strings with inline credentials
# Example: ['DBI:mysql:database=hermes;host=db;port=3306', 'hermes', 'thepassword']
[[rules]]
id = "hermes-dbi-connection-string"
description = "DBI/JDBC connection string with inline credentials"
regex = '''(?i)(DBI|jdbc)[:\w]*[^'"]*['"][,\s]+['"][^'"]+['"][,\s]+['"][a-zA-Z0-9!@#$%^&*()]{8,}['"]'''
secretGroup = 0
entropy = 3.0
keywords = ["DBI", "jdbc"]

# Catches: Hibernate XML connection password
# Example: <property name="connection.password">thepassword</property>
[[rules]]
id = "hermes-hibernate-password"
description = "Hibernate XML connection password"
regex = '''(?i)connection\.password['"]*>[a-zA-Z0-9!@#$%^&*()]{8,}<'''
secretGroup = 0
entropy = 3.0
keywords = ["connection.password"]

# Catches: connect = "host=... password=value" (Dovecot dict-sql format)
[[rules]]
id = "hermes-connect-string-password"
description = "Connect string with inline password"
regex = '''(?i)connect\s*=\s*["'][^"']*password\s*=\s*[a-zA-Z0-9!@#$%^&*()]{8,}'''
secretGroup = 0
entropy = 3.0
keywords = ["connect"]

[[rules]]
id = "hermes-encryption-key"
description = "Encryption key file content"
regex = '''[a-f0-9]{64,}'''
entropy = 4.0
path = '''(?i)\.key$'''

[[rules]]
id = "hermes-api-key"
description = "API key pattern"
regex = '''(?i)(api[_-]?key|apikey)\s*[=:]\s*['"]?[a-zA-Z0-9_-]{20,}['"]?'''
secretGroup = 0
entropy = 3.0
keywords = ["api_key", "apikey"]
[rules.allowlist]
regexes = [
    '''YOUR-API-KEY''',
    '''api_key\s*=\s*$''',
    '''apikey\s*=\s*$'''
]

[[rules]]
id = "hermes-private-key"
description = "Private key in file"
regex = '''-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----'''
keywords = ["BEGIN", "PRIVATE", "KEY"]

[[rules]]
id = "hermes-ip-internal"
description = "Internal IP address (192.168.x.x)"
regex = '''192\.168\.\d{1,3}\.\d{1,3}'''
entropy = 0
[rules.allowlist]
paths = [
    '''README''',
    '''\.md$''',
    '''view_intrusion_prevention\.cfm''',
    '''fail2ban'''
]

# Paths to exclude from scanning
[allowlist]
description = "Global allowlist"
paths = [
    # Template files with placeholder values (hermes_db_password, etc.)
    '''config/hermes/opt/hermes/templates/''',

    # Plugin/vendor files
    '''plugins/''',
    '''node_modules/''',

    # Documentation
    '''\.md$''',
    '''README''',
    '''RELEASE-NOTES''',

    # Lock files
    '''package-lock\.json''',
    '''yarn\.lock''',

    # Generated map files
    '''\.map$''',

    # Vendored / build binaries (ciphermail .deb, tomcat tarball) -- not our
    # secrets; scanning binary content produces false positives.
    '''\.deb$''',
    '''\.tar\.gz$''',
    '''\.tar\.xz$''',

    # Fail2ban default configs (not our secrets)
    '''config/fail2ban/config/fail2ban/action\.d/''',
    '''config/fail2ban/config/fail2ban/jail\.conf''',

    # Test/example files
    '''test/''',
    '''tests/''',
    '''\.example'''
]

# Files that are already gitignored but might be in git history
regexes = [
    '''config/certbot/''',
    '''config/authelia/''',
    '''config/hermes/opt/hermes/keys/''',
    '''config/hermes/opt/hermes/ssl/''',
    '''config/hermes/opt/hermes/CA/''',
    '''config/hermes/opt/hermes/creds/''',
    '''schedule/.*_ad_tasks\.cfm''',
    '''\.env$'''
]