title = "Nereus gitleaks configuration"

[extend]
useDefault = true

[[allowlists]]
description = "Encrypted SealedSecret values are ciphertext, not plaintext credentials."
condition = "AND"
targetRules = ["generic-api-key"]
regexTarget = "line"
paths = ['''^deploy/secrets/[^/]+-sealed\.yaml$''']
regexes = ['''^\s+(POSTGRES_PASSWORD|DATABASE_URL):\s+Ag[A-Za-z0-9+/=]+\s*$''']