97 lines
4.4 KiB
YAML
97 lines
4.4 KiB
YAML
# Trivy secret scanning configuration.
|
|
# Docs: https://trivy.dev/docs/latest/scanner/secret/
|
|
#
|
|
# Every suppressed file is listed explicitly. Production files also require
|
|
# a content-specific regex so new real secrets in the same file still trigger.
|
|
|
|
allow-rules:
|
|
|
|
# ---- Test/dev private keys and TLS certs (not production) ----
|
|
|
|
- id: test-key-osquery-iab
|
|
path: ^tools/osquery/in-a-box/osquery/fleet.key$
|
|
|
|
- id: test-key-osquery
|
|
path: ^tools/osquery/fleet.key$
|
|
|
|
- id: test-key-smtp4dev
|
|
path: ^tools/smtp4dev/fleet.key$
|
|
|
|
- id: test-key-orbit-mtls
|
|
path: ^tools/test-orbit-mtls/client.key$
|
|
|
|
- id: test-key-intermediate-ca
|
|
path: ^tools/test-certs/intermediate-ca/intermediate.key.pem$
|
|
|
|
- id: test-key-root-ca
|
|
path: ^tools/test-certs/root-ca/root-ca.key.pem$
|
|
|
|
- id: test-key-server-cert
|
|
path: ^tools/test-certs/server/server.key.pem$
|
|
|
|
- id: test-key-upgrade
|
|
path: ^test/upgrade/fleet.key$
|
|
|
|
- id: test-key-service-testdata
|
|
path: ^server/service/testdata/client.key$
|
|
|
|
- id: test-key-cryptoutil-rsa
|
|
path: ^server/mdm/cryptoutil/testdata/pkcs8-rsa.key$
|
|
|
|
- id: test-key-cryptoutil-x25519
|
|
path: ^server/mdm/cryptoutil/testdata/pkcs8-x25519.key$
|
|
|
|
- id: test-key-certificate
|
|
path: ^pkg/certificate/testdata/test.key$
|
|
|
|
- id: test-key-client-testdata
|
|
path: ^client/testdata/client.key$
|
|
|
|
- id: test-key-insecure-proxy
|
|
path: ^orbit/pkg/insecure/proxy.go$
|
|
|
|
- id: test-key-httpsigproxy
|
|
path: ^ee/orbit/pkg/httpsigproxy/httpsigproxy.go$
|
|
|
|
# ---- Production files (path + content-specific regex) ----
|
|
|
|
- id: serve-dev-license-jwts
|
|
description: "Hardcoded dev/expired license JWTs for --dev_license flag"
|
|
path: "^cmd/fleet/serve\\.go$"
|
|
regex: "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9\\."
|
|
|
|
- id: calendars-gcp-placeholder
|
|
description: "GCP service account JSON placeholder shown in the UI"
|
|
path: "^frontend/pages/admin/IntegrationsPage/cards/Calendars/Calendars\\.tsx$"
|
|
regex: "fleet-in-your-calendar"
|
|
|
|
- id: sails-fake-stripe-website
|
|
description: "Placeholder Stripe keys in website Sails config"
|
|
path: "^(website/config/custom\\.js|website/config/env/production\\.js|website/config/env/staging\\.js|website/views/pages/faq\\.ejs)$"
|
|
regex: "(sk_test_Zzd814|pk_test_Zzd814|sk_prod__fake_Nfgh|sk_sandbox__fake_Nfgh|pk_sandbox__fake_fKd3)"
|
|
|
|
- id: sails-fake-stripe-agent-downloader
|
|
description: "Placeholder Stripe keys in fleet-agent-downloader Sails config"
|
|
path: "^(ee/fleet-agent-downloader/config/custom\\.js|ee/fleet-agent-downloader/config/env/production\\.js|ee/fleet-agent-downloader/config/env/staging\\.js)$"
|
|
regex: "(sk_test_Zzd814|pk_test_Zzd814|sk_prod__fake_Nfgh|sk_sandbox__fake_Nfgh|pk_sandbox__fake_fKd3)"
|
|
|
|
- id: sails-fake-stripe-vuln-dashboard
|
|
description: "Placeholder Stripe keys in vulnerability-dashboard Sails config"
|
|
path: "^(ee/vulnerability-dashboard/config/custom\\.js|ee/vulnerability-dashboard/config/env/production\\.js|ee/vulnerability-dashboard/config/env/staging\\.js|ee/vulnerability-dashboard/views/pages/homepage\\.ejs|ee/vulnerability-dashboard/views/pages/faq\\.ejs|ee/vulnerability-dashboard/assets/js/utilities/open-stripe-checkout\\.js)$"
|
|
regex: "(sk_test_Zzd814|pk_test_Zzd814|pk_test_Qz5RfD|sk_prod__fake_Nfgh|sk_sandbox__fake_Nfgh|pk_sandbox__fake_fKd3)"
|
|
|
|
- id: sails-fake-sendgrid-website
|
|
description: "Placeholder SendGrid key in website Sails config"
|
|
path: "^(website/config/custom\\.js|website/config/env/production\\.js|website/config/env/staging\\.js|website/views/pages/faq\\.ejs)$"
|
|
regex: "SG\\.fake\\.3e0Bn0qSQVnwb1E4qNPz9JZP5vLZYqjh7sn8S93oSHU"
|
|
|
|
- id: sails-fake-sendgrid-agent-downloader
|
|
description: "Placeholder SendGrid key in fleet-agent-downloader Sails config"
|
|
path: "^(ee/fleet-agent-downloader/config/custom\\.js|ee/fleet-agent-downloader/config/env/production\\.js|ee/fleet-agent-downloader/config/env/staging\\.js)$"
|
|
regex: "SG\\.fake\\.3e0Bn0qSQVnwb1E4qNPz9JZP5vLZYqjh7sn8S93oSHU"
|
|
|
|
- id: sails-fake-sendgrid-vuln-dashboard
|
|
description: "Placeholder SendGrid key in vulnerability-dashboard Sails config"
|
|
path: "^(ee/vulnerability-dashboard/config/custom\\.js|ee/vulnerability-dashboard/config/env/production\\.js|ee/vulnerability-dashboard/config/env/staging\\.js|ee/vulnerability-dashboard/views/pages/homepage\\.ejs|ee/vulnerability-dashboard/views/pages/faq\\.ejs)$"
|
|
regex: "SG\\.fake\\.3e0Bn0qSQVnwb1E4qNPz9JZP5vLZYqjh7sn8S93oSHU"
|