# What GitLab's secret detection (the secret_detection job, .gitlab/ci/gitlab-security.yml)
# found in the history and is not a secret: gitleaks reads this file from the root of the
# checkout and leaves each finding named here out of its report. One finding a line, as
# gitleaks prints its fingerprint: <commit>:<file>:<rule>:<line>.
#
# A scan of the whole history on 26 September 2026 (the analyzer image the job pins,
# gitleaks 8.30.1 with GitLab's rules 0.25.1, over a full clone: master at 40c7d3e0c and
# its tags, the five c71a6de74 lines being upstream history only the 5.x tags reach) found
# these 30, and each was read in its commit:
#
#   - the PEM and OpenPGP armour lines the server's own testers feed the key parsers,
#     so that a private key is refused (GatewayEncryption.cpp, OpenPgpKey.cpp,
#     DkimRotationPlan.cpp): a header and a few bytes, no key;
#   - the example access key id of AWS's own Signature Version 4 examples, which
#     ObjectStoreSignature.cpp's tester signs against;
#   - keys made for the regression tests and used for nothing else (the OpenPGP,
#     SAML, gateway-encryption and TLS fixtures), and the sample keys under
#     hmailserver/test/SSL examples and Boost's asio examples, which have been
#     public since they were first committed.
#
# A finding that is not listed here fails the job. Add a line only for something read
# and found not to be a secret, and say what it is in the commit; a real secret is
# revoked where it was issued, not listed here (SECURITY.md).
13c961059ff4fda1a5644c204483165cc3edb670:hmailserver/source/Server/Common/Util/ObjectStoreSignature.cpp:AWS:529
8fe98184ddd8254ec78933e9bd903d36d94c7edb:hmailserver/test/RegressionTests/API/SamlSignIn.cs:PKCS8 private key:710
1bdc318610d3c9c45c10b27469539ad79659898a:hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:SSH (EC) private key:1553
1bdc318610d3c9c45c10b27469539ad79659898a:hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:SSH (EC) private key:1556
1bdc318610d3c9c45c10b27469539ad79659898a:hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:PKCS8 private key:1548
1bdc318610d3c9c45c10b27469539ad79659898a:hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:PKCS8 private key:1637
1bdc318610d3c9c45c10b27469539ad79659898a:hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:SSH private key:1557
1bdc318610d3c9c45c10b27469539ad79659898a:hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:PGP private key:1544
1bdc318610d3c9c45c10b27469539ad79659898a:hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:PGP private key:1557
1bdc318610d3c9c45c10b27469539ad79659898a:hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:PGP private key:1773
1bdc318610d3c9c45c10b27469539ad79659898a:hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:RSA private key:1556
1bdc318610d3c9c45c10b27469539ad79659898a:hmailserver/test/RegressionTests/SMTP/GatewayEncryption.cs:PKCS8 private key:82
2e748ceae80fee444973ecc36becf4134d2e726a:hmailserver/source/Server/Common/Util/OpenPgpKey.cpp:PGP private key:892
2e748ceae80fee444973ecc36becf4134d2e726a:hmailserver/test/RegressionTests/API/RestApiOpenPgpKeys.cs:PGP private key:114
2e748ceae80fee444973ecc36becf4134d2e726a:hmailserver/test/RegressionTests/Shared/OpenPgpTestSupport.cs:PGP private key:184
2e748ceae80fee444973ecc36becf4134d2e726a:hmailserver/test/RegressionTests/Shared/OpenPgpTestSupport.cs:PGP private key:204
2e748ceae80fee444973ecc36becf4134d2e726a:hmailserver/test/RegressionTests/Shared/OpenPgpTestSupport.cs:PGP private key:290
c893043d824e2965e3a52848f83104e8147bd288:hmailserver/source/Server/Common/Util/OpenPgpKey.cpp:PGP private key:893
c893043d824e2965e3a52848f83104e8147bd288:hmailserver/source/Server/Common/Util/OpenPgpKey.cpp:PGP private key:1329
c893043d824e2965e3a52848f83104e8147bd288:hmailserver/test/RegressionTests/Shared/OpenPgpTestSupport.cs:PGP private key:76
11c0abbd81bf3825bfda51529a72c3e4575d48fd:hmailserver/source/Server/Common/AntiSpam/DKIM/DkimRotationPlan.cpp:PKCS8 private key:673
f36d28d6332de8456e5294e15d0495057529dceb:hmailserver/test/RegressionTests/Security/TlsAcmeDeployment.cs:PKCS8 private key:52
6cc10cc99443dce31f9b8c2e31f56da0ead696d4:hmailserver/test/RegressionTests/Security/TlsCertificateValidity.cs:RSA private key:66
fe45f43c3db6c40dfdb42c57f3db2cc312d53af1:hmailserver/test/SSL examples/example.key:PKCS8 private key:1
fe45f43c3db6c40dfdb42c57f3db2cc312d53af1:hmailserver/test/SSL examples/example.key.org:RSA private key:1
c71a6de74c8e169d03ee71e0be29fbd00fc639f8:hmailserver/test/SSL examples/WithPassword/server.key:RSA private key:1
c71a6de74c8e169d03ee71e0be29fbd00fc639f8:hmailserver/test/SSL examples/example.key.org:RSA private key:1
c71a6de74c8e169d03ee71e0be29fbd00fc639f8:hmailserver/test/SSL examples/example.key:RSA private key:1
c71a6de74c8e169d03ee71e0be29fbd00fc639f8:libraries/boost_1_52_0/libs/asio/example/ssl/ca.pem:RSA private key:14
c71a6de74c8e169d03ee71e0be29fbd00fc639f8:libraries/boost_1_52_0/libs/asio/example/ssl/server.pem:RSA private key:14
#
# And twelve more, found on 26 September 2026 by the landing's own scan (build/scan-secrets.py)
# in batch40's commits before they reached master, each read in its commit: the same
# AWS example access key id, quoted in docs/ContinuousIntegration.md, in this file's
# comment above and in HelpPagesData.cpp, which build/generate-help-pages.py makes from
# the document and which each regeneration added again at another line. The three files
# describe the key since, and no longer quote it, so no regeneration adds it again. The
# lines name the commits as batch40 was rebased onto master 95febd2fa, in a line (the ten
# written before named the commits before the rebase); the two at HelpPagesData.cpp's
# lines 355 and 356 are the mrflow and sbom folds, which regenerated it while the document
# still quoted the key.
ac35b402b5b09104ca31df3515e4d73821a8baf0:hmailserver/source/Server/Common/Util/HelpPagesData.cpp:AWS:346
ac35b402b5b09104ca31df3515e4d73821a8baf0:hmailserver/docs/ContinuousIntegration.md:AWS:1488
ac35b402b5b09104ca31df3515e4d73821a8baf0:.gitleaksignore:AWS:14
318b615c5495bff447f2bd957869eb24fac85904:hmailserver/source/Server/Common/Util/HelpPagesData.cpp:AWS:347
c2d53e36c4281ee1b890de2c82f2fa2f90a3af51:hmailserver/source/Server/Common/Util/HelpPagesData.cpp:AWS:348
4a4fd988e09c6549563d907193e7d7784d5af56f:hmailserver/source/Server/Common/Util/HelpPagesData.cpp:AWS:350
77ae713cdf9da2980b7ef736e27ca15cd2fdbd4a:hmailserver/source/Server/Common/Util/HelpPagesData.cpp:AWS:350
3274dcdd7c33605ce22f3ecde51e783d805ab55f:hmailserver/source/Server/Common/Util/HelpPagesData.cpp:AWS:350
c19f5481847677b677d566cb17aea5ee5a6ef3a8:hmailserver/source/Server/Common/Util/HelpPagesData.cpp:AWS:350
88d89cefa01801d8357ba30c5f0d18463c8baaf6:hmailserver/source/Server/Common/Util/HelpPagesData.cpp:AWS:350
00587974da0214b80bafd0729906c8170f20e90b:hmailserver/source/Server/Common/Util/HelpPagesData.cpp:AWS:355
020f6c6c7c230606c937f2ac87422d2c29a0e9d6:hmailserver/source/Server/Common/Util/HelpPagesData.cpp:AWS:356

# The same findings as a DIRECTORY scan names them. A pipeline started by a push or
# through the API scans the checkout as files, not the history (the analyzer's
# FetchNone strategy), and gitleaks then prints <path as scanned>:<rule id>:<line>
# with no commit - the path under CI_PROJECT_DIR and the rule's id (AWS), not its
# title - so none of the lines above matched and the same 24 fixtures failed master's
# pipeline 2886389460 on 27 September 2026. Each line below is one of those, read
# again in the tree at 6bc09509d: the tester PEM and armour fragments, the SigV4
# example access key, and the regression suite's own keys. A line moves when its file
# is edited above it; the job then names the finding again, and the line is written
# anew once it has been read again. The prefix is CI_PROJECT_DIR, /builds/<the
# project's path>: /builds/hmailserver/hmailserver since the project moved into the
# group hmailserver on 29 September 2026 (/builds/Progressiverobot/hmailserver
# before), and a move to another path changes it again. The landing's own scan
# (build/scan-secrets.py) reads commits, never a directory, and is matched by the
# lines above; these are the pipeline's alone.
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/AntiSpam/DKIM/DkimRotationPlan.cpp:PKCS8 private key:729
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:PGP private key:1634
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:PGP private key:1647
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:PGP private key:1863
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:PKCS8 private key:1638
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:PKCS8 private key:1727
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:RSA private key:1646
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:SSH (EC) private key:1643
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:SSH (EC) private key:1646
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:SSH private key:1647
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/Util/ObjectStoreSignature.cpp:AWS:529
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/Util/OpenPgpKey.cpp:PGP private key:1500
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/Util/OpenPgpKey.cpp:PGP private key:899
/builds/hmailserver/hmailserver/hmailserver/test/RegressionTests/API/RestApiOpenPgpKeys.cs:PGP private key:121
/builds/hmailserver/hmailserver/hmailserver/test/RegressionTests/API/SamlSignIn.cs:PKCS8 private key:723
/builds/hmailserver/hmailserver/hmailserver/test/RegressionTests/SMTP/GatewayEncryption.cs:PKCS8 private key:82
/builds/hmailserver/hmailserver/hmailserver/test/RegressionTests/Security/TlsAcmeDeployment.cs:PKCS8 private key:52
/builds/hmailserver/hmailserver/hmailserver/test/RegressionTests/Security/TlsCertificateValidity.cs:RSA private key:68
/builds/hmailserver/hmailserver/hmailserver/test/RegressionTests/Shared/OpenPgpTestSupport.cs:PGP private key:103
/builds/hmailserver/hmailserver/hmailserver/test/RegressionTests/Shared/OpenPgpTestSupport.cs:PGP private key:252
/builds/hmailserver/hmailserver/hmailserver/test/RegressionTests/Shared/OpenPgpTestSupport.cs:PGP private key:272
/builds/hmailserver/hmailserver/hmailserver/test/RegressionTests/Shared/OpenPgpTestSupport.cs:PGP private key:358
/builds/hmailserver/hmailserver/hmailserver/test/SSL examples/example.key.org:RSA private key:1
/builds/hmailserver/hmailserver/hmailserver/test/SSL examples/example.key:PKCS8 private key:1

# batch41, 27 September 2026: the Control Panel test RestSettingsTests.
# TrustsCertificate_ThatIsTheOneTheListenerServes_OnlyThat put a PEM private-key
# placeholder - "AAAA" between the two markers - before a certificate chain, to show
# the leaf is found after a key. It is no key. The test writes the markers in two
# pieces since the next commit, so the tree holds no match; this line is for the
# commit that added it, which the history scan and the landing's range scan read.
018bb567b8a06dd701fd00dc8c1b788ad34f584f:hmailserver/source/Tools/ControlPanel.Tests/Services/RestSettingsTests.cs:PKCS8 private key:273
#
# batch42, 30 September 2026: two of the links the SURBL fold's tests feed the link-host reader,
# to show that the host looked up is the one after the user information: SURBL.cpp's tester
# row "brackets in the user name", whose user name is an IPv6 documentation address in
# brackets, and a link in the regression test Basics.cs with a made-up user name and password
# before a test name. The rule reads each as a user and a password; neither is a credential
# for anything. They are described, not quoted, here, since a quoted one is a finding again.
# The landing's range scan found them in the fold's commit, and a directory scan of the tree at
# 108d3850f (the image the job pins, on linix) at the same lines; one line of each form.
# 1 October 2026: b42-surbl2 moved the two lines; the directory-scan entries follow them to
# SURBL.cpp 1886 and Basics.cs 504 (the commit-keyed entries name the lines in their own commit).
37324d9689e55e6d6c592436b7d25589c658a15d:hmailserver/source/Server/Common/AntiSpam/SURBL.cpp:Password in URL:1115
37324d9689e55e6d6c592436b7d25589c658a15d:hmailserver/test/RegressionTests/AntiSpam/Basics.cs:Password in URL:500
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/AntiSpam/SURBL.cpp:Password in URL:1886
/builds/hmailserver/hmailserver/hmailserver/test/RegressionTests/AntiSpam/Basics.cs:Password in URL:504
