# What GitLab's secret detection (the secret_detection job, .gitlab/ci/gitlab-security.yml)
# found in the history and is not a secret: gitleaks reads this file from the root of the
# checkout and leaves each finding named here out of its report. One finding a line, as
# gitleaks prints its fingerprint: <commit>:<file>:<rule>:<line>.
#
# A scan of the whole history on 26 September 2026 (the analyzer image the job pins,
# gitleaks 8.30.1 with GitLab's rules 0.25.1, over a full clone: master at 40c7d3e0c and
# its tags, the five c71a6de74 lines being upstream history only the 5.x tags reach) found
# these 30, and each was read in its commit:
#
#   - the PEM and OpenPGP armour lines the server's own testers feed the key parsers,
#     so that a private key is refused (GatewayEncryption.cpp, OpenPgpKey.cpp,
#     DkimRotationPlan.cpp): a header and a few bytes, no key;
#   - the example access key id of AWS's own Signature Version 4 examples, which
#     ObjectStoreSignature.cpp's tester signs against;
#   - keys made for the regression tests and used for nothing else (the OpenPGP,
#     SAML, gateway-encryption and TLS fixtures), and the sample keys under
#     hmailserver/test/SSL examples and Boost's asio examples, which have been
#     public since they were first committed.
#
# A finding that is not listed here fails the job. Add a line only for something read
# and found not to be a secret, and say what it is in the commit; a real secret is
# revoked where it was issued, not listed here (SECURITY.md).
13c961059ff4fda1a5644c204483165cc3edb670:hmailserver/source/Server/Common/Util/ObjectStoreSignature.cpp:AWS:529
8fe98184ddd8254ec78933e9bd903d36d94c7edb:hmailserver/test/RegressionTests/API/SamlSignIn.cs:PKCS8 private key:710
1bdc318610d3c9c45c10b27469539ad79659898a:hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:SSH (EC) private key:1553
1bdc318610d3c9c45c10b27469539ad79659898a:hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:SSH (EC) private key:1556
1bdc318610d3c9c45c10b27469539ad79659898a:hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:PKCS8 private key:1548
1bdc318610d3c9c45c10b27469539ad79659898a:hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:PKCS8 private key:1637
1bdc318610d3c9c45c10b27469539ad79659898a:hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:SSH private key:1557
1bdc318610d3c9c45c10b27469539ad79659898a:hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:PGP private key:1544
1bdc318610d3c9c45c10b27469539ad79659898a:hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:PGP private key:1557
1bdc318610d3c9c45c10b27469539ad79659898a:hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:PGP private key:1773
1bdc318610d3c9c45c10b27469539ad79659898a:hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:RSA private key:1556
1bdc318610d3c9c45c10b27469539ad79659898a:hmailserver/test/RegressionTests/SMTP/GatewayEncryption.cs:PKCS8 private key:82
2e748ceae80fee444973ecc36becf4134d2e726a:hmailserver/source/Server/Common/Util/OpenPgpKey.cpp:PGP private key:892
2e748ceae80fee444973ecc36becf4134d2e726a:hmailserver/test/RegressionTests/API/RestApiOpenPgpKeys.cs:PGP private key:114
2e748ceae80fee444973ecc36becf4134d2e726a:hmailserver/test/RegressionTests/Shared/OpenPgpTestSupport.cs:PGP private key:184
2e748ceae80fee444973ecc36becf4134d2e726a:hmailserver/test/RegressionTests/Shared/OpenPgpTestSupport.cs:PGP private key:204
2e748ceae80fee444973ecc36becf4134d2e726a:hmailserver/test/RegressionTests/Shared/OpenPgpTestSupport.cs:PGP private key:290
c893043d824e2965e3a52848f83104e8147bd288:hmailserver/source/Server/Common/Util/OpenPgpKey.cpp:PGP private key:893
c893043d824e2965e3a52848f83104e8147bd288:hmailserver/source/Server/Common/Util/OpenPgpKey.cpp:PGP private key:1329
c893043d824e2965e3a52848f83104e8147bd288:hmailserver/test/RegressionTests/Shared/OpenPgpTestSupport.cs:PGP private key:76
11c0abbd81bf3825bfda51529a72c3e4575d48fd:hmailserver/source/Server/Common/AntiSpam/DKIM/DkimRotationPlan.cpp:PKCS8 private key:673
f36d28d6332de8456e5294e15d0495057529dceb:hmailserver/test/RegressionTests/Security/TlsAcmeDeployment.cs:PKCS8 private key:52
6cc10cc99443dce31f9b8c2e31f56da0ead696d4:hmailserver/test/RegressionTests/Security/TlsCertificateValidity.cs:RSA private key:66
fe45f43c3db6c40dfdb42c57f3db2cc312d53af1:hmailserver/test/SSL examples/example.key:PKCS8 private key:1
fe45f43c3db6c40dfdb42c57f3db2cc312d53af1:hmailserver/test/SSL examples/example.key.org:RSA private key:1
c71a6de74c8e169d03ee71e0be29fbd00fc639f8:hmailserver/test/SSL examples/WithPassword/server.key:RSA private key:1
c71a6de74c8e169d03ee71e0be29fbd00fc639f8:hmailserver/test/SSL examples/example.key.org:RSA private key:1
c71a6de74c8e169d03ee71e0be29fbd00fc639f8:hmailserver/test/SSL examples/example.key:RSA private key:1
c71a6de74c8e169d03ee71e0be29fbd00fc639f8:libraries/boost_1_52_0/libs/asio/example/ssl/ca.pem:RSA private key:14
c71a6de74c8e169d03ee71e0be29fbd00fc639f8:libraries/boost_1_52_0/libs/asio/example/ssl/server.pem:RSA private key:14
#
# And twelve more, found on 26 September 2026 by the landing's own scan (build/scan-secrets.py)
# in batch40's commits before they reached master, each read in its commit: the same
# AWS example access key id, quoted in docs/ContinuousIntegration.md, in this file's
# comment above and in HelpPagesData.cpp, which build/generate-help-pages.py makes from
# the document and which each regeneration added again at another line. The three files
# describe the key since, and no longer quote it, so no regeneration adds it again. The
# lines name the commits as batch40 was rebased onto master 95febd2fa, in a line (the ten
# written before named the commits before the rebase); the two at HelpPagesData.cpp's
# lines 355 and 356 are the mrflow and sbom folds, which regenerated it while the document
# still quoted the key.
ac35b402b5b09104ca31df3515e4d73821a8baf0:hmailserver/source/Server/Common/Util/HelpPagesData.cpp:AWS:346
ac35b402b5b09104ca31df3515e4d73821a8baf0:hmailserver/docs/ContinuousIntegration.md:AWS:1488
ac35b402b5b09104ca31df3515e4d73821a8baf0:.gitleaksignore:AWS:14
318b615c5495bff447f2bd957869eb24fac85904:hmailserver/source/Server/Common/Util/HelpPagesData.cpp:AWS:347
c2d53e36c4281ee1b890de2c82f2fa2f90a3af51:hmailserver/source/Server/Common/Util/HelpPagesData.cpp:AWS:348
4a4fd988e09c6549563d907193e7d7784d5af56f:hmailserver/source/Server/Common/Util/HelpPagesData.cpp:AWS:350
77ae713cdf9da2980b7ef736e27ca15cd2fdbd4a:hmailserver/source/Server/Common/Util/HelpPagesData.cpp:AWS:350
3274dcdd7c33605ce22f3ecde51e783d805ab55f:hmailserver/source/Server/Common/Util/HelpPagesData.cpp:AWS:350
c19f5481847677b677d566cb17aea5ee5a6ef3a8:hmailserver/source/Server/Common/Util/HelpPagesData.cpp:AWS:350
88d89cefa01801d8357ba30c5f0d18463c8baaf6:hmailserver/source/Server/Common/Util/HelpPagesData.cpp:AWS:350
00587974da0214b80bafd0729906c8170f20e90b:hmailserver/source/Server/Common/Util/HelpPagesData.cpp:AWS:355
020f6c6c7c230606c937f2ac87422d2c29a0e9d6:hmailserver/source/Server/Common/Util/HelpPagesData.cpp:AWS:356

# The same findings as a DIRECTORY scan names them. A pipeline started by a push or
# through the API scans the checkout as files, not the history (the analyzer's
# FetchNone strategy), and gitleaks then prints <path as scanned>:<rule id>:<line>
# with no commit - the path under CI_PROJECT_DIR and the rule's id (AWS), not its
# title - so none of the lines above matched and the same 24 fixtures failed master's
# pipeline 2886389460 on 27 September 2026. Each line below is one of those, read
# again in the tree at 6bc09509d: the tester PEM and armour fragments, the SigV4
# example access key, and the regression suite's own keys. A line moves when its file
# is edited above it: build/check-gitleaksignore.py, which checkers runs, then fails
# the change that moved it, naming the line the finding is on now, and the line here
# is written anew once the finding has been read again. The prefix is CI_PROJECT_DIR,
# /builds/<the project's path>: /builds/hmailserver/hmailserver since the project
# moved into the group hmailserver on 29 September 2026
# (/builds/Progressiverobot/hmailserver before), and a move to another path changes
# it again. The landing's own scan (build/scan-secrets.py) reads commits, never a
# directory, and is matched by the lines above; these are the pipeline's alone.
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/AntiSpam/DKIM/DkimRotationPlan.cpp:PKCS8 private key:728
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:PGP private key:1634
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:PGP private key:1647
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:PGP private key:1863
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:PKCS8 private key:1638
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:PKCS8 private key:1727
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:RSA private key:1646
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:SSH (EC) private key:1643
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:SSH (EC) private key:1646
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/Util/GatewayEncryption.cpp:SSH private key:1647
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/Util/ObjectStoreSignature.cpp:AWS:527
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/Util/OpenPgpKey.cpp:PGP private key:1500
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/Util/OpenPgpKey.cpp:PGP private key:899
/builds/hmailserver/hmailserver/hmailserver/test/RegressionTests/API/RestApiOpenPgpKeys.cs:PGP private key:121
/builds/hmailserver/hmailserver/hmailserver/test/RegressionTests/API/SamlSignIn.cs:PKCS8 private key:751
/builds/hmailserver/hmailserver/hmailserver/test/RegressionTests/SMTP/GatewayEncryption.cs:PKCS8 private key:82
/builds/hmailserver/hmailserver/hmailserver/test/RegressionTests/Security/TlsAcmeDeployment.cs:PKCS8 private key:52
/builds/hmailserver/hmailserver/hmailserver/test/RegressionTests/Security/TlsCertificateValidity.cs:RSA private key:68
/builds/hmailserver/hmailserver/hmailserver/test/RegressionTests/Shared/OpenPgpTestSupport.cs:PGP private key:103
/builds/hmailserver/hmailserver/hmailserver/test/RegressionTests/Shared/OpenPgpTestSupport.cs:PGP private key:252
/builds/hmailserver/hmailserver/hmailserver/test/RegressionTests/Shared/OpenPgpTestSupport.cs:PGP private key:272
/builds/hmailserver/hmailserver/hmailserver/test/RegressionTests/Shared/OpenPgpTestSupport.cs:PGP private key:358
/builds/hmailserver/hmailserver/hmailserver/test/SSL examples/example.key.org:RSA private key:1
/builds/hmailserver/hmailserver/hmailserver/test/SSL examples/example.key:PKCS8 private key:1

# batch41, 27 September 2026: the Control Panel test RestSettingsTests.
# TrustsCertificate_ThatIsTheOneTheListenerServes_OnlyThat put a PEM private-key
# placeholder - "AAAA" between the two markers - before a certificate chain, to show
# the leaf is found after a key. It is no key. The test writes the markers in two
# pieces since the next commit, so the tree holds no match; this line is for the
# commit that added it, which the history scan and the landing's range scan read.
018bb567b8a06dd701fd00dc8c1b788ad34f584f:hmailserver/source/Tools/ControlPanel.Tests/Services/RestSettingsTests.cs:PKCS8 private key:273
#
# batch42, 30 September 2026: two of the links the SURBL fold's tests feed the link-host reader,
# to show that the host looked up is the one after the user information: SURBL.cpp's tester
# row "brackets in the user name", whose user name is an IPv6 documentation address in
# brackets, and a link in the regression test Basics.cs with a made-up user name and password
# before a test name. The rule reads each as a user and a password; neither is a credential
# for anything. They are described, not quoted, here, since a quoted one is a finding again.
# The landing's range scan found them in the fold's commit, and a directory scan of the tree at
# 108d3850f (the image the job pins, on linix) at the same lines; one line of each form.
# 1 October 2026: b42-surbl2 moved the two lines; the directory-scan entries follow them to
# SURBL.cpp 1886 and Basics.cs 504 (the commit-keyed entries name the lines in their own commit).
# 10 October 2026: SURBL.cpp's has moved on to 2625 (below).
# 14 October 2026, batch48's fold: SURBL.cpp's to 3349 (dns-failed-lookup's and idn-uts46's
# edits above it) and Basics.cs's to 507 (idn-uts46's), each read again, the same fixture.
37324d9689e55e6d6c592436b7d25589c658a15d:hmailserver/source/Server/Common/AntiSpam/SURBL.cpp:Password in URL:1115
37324d9689e55e6d6c592436b7d25589c658a15d:hmailserver/test/RegressionTests/AntiSpam/Basics.cs:Password in URL:500
/builds/hmailserver/hmailserver/hmailserver/source/Server/Common/AntiSpam/SURBL.cpp:Password in URL:3349
/builds/hmailserver/hmailserver/hmailserver/test/RegressionTests/AntiSpam/Basics.cs:Password in URL:507
#
# b53-ci, 10 October 2026: what both scans find now that they read every path under a
# directory named build, bin, obj, target or packages, which GitLab's rules left out
# (their global allowlist). gitleaks in the image secret_detection pins,
# with the rules both scans now make (build/ci/secret-detection-rules.sh), over every
# branch and tag of the project on GitLab (2,873 commits, master at 74aed9ab8) and over
# master's tree, found five, each read in its commit and none a secret - the five
# ccbbfda19 named on 9 October:
#
#   - the secret keys of the OpenPGP fixtures' alice and bob (build/fixtures/openpgp,
#     added in 2e748ceae): test keys made by build/make-openpgp-fixtures.sh for
#     build/check-portal-openpgp.js, their passphrase printed in the README beside
#     them, their addresses in the .test top-level domain, trusted by nothing;
#   - three lines that test a text for a private key's armour header, and hold no key:
#     build/ci/installer-smoke.ps1, which checks that the key file it was given begins
#     "BEGIN PRIVATE KEY" and prints no more of it; build/generate-package-repos.py,
#     which reads a signing key given inline when the text begins with the OpenPGP
#     private key header; and build/deck-script-test.js, which puts a header, four A's
#     and a footer in the Control Deck's key field to see the page refuse it.
#
# The analyzer's own whole-history scan names the three lines and not the two keys,
# which .gitattributes marks binary, so that its git log shows no line of them; gitleaks
# as scan-secrets.py runs it names all five. Each in both forms: the commit that added
# it, and the line in master's tree for the directory scan of a pipeline started through
# the API. The tree's scan, the same day, also found four of the directory entries above
# moved by later edits of their files - DkimRotationPlan.cpp 729 to 728,
# ObjectStoreSignature.cpp 529 to 527, SamlSignIn.cs 723 to 751 and SURBL.cpp 1886 to
# 2625 - each read again, the same fixture at its new line.
2e748ceae80fee444973ecc36becf4134d2e726a:build/fixtures/openpgp/alice.sec.asc:PGP private key:1
2e748ceae80fee444973ecc36becf4134d2e726a:build/fixtures/openpgp/bob.sec.asc:PGP private key:1
578ec47b7f9e18999553258e070d53e66be4dc99:build/ci/installer-smoke.ps1:PKCS8 private key:1338
77ae713cdf9da2980b7ef736e27ca15cd2fdbd4a:build/generate-package-repos.py:PGP private key:351
c893043d824e2965e3a52848f83104e8147bd288:build/deck-script-test.js:PGP private key:2412
/builds/hmailserver/hmailserver/build/fixtures/openpgp/alice.sec.asc:PGP private key:1
/builds/hmailserver/hmailserver/build/fixtures/openpgp/bob.sec.asc:PGP private key:1
/builds/hmailserver/hmailserver/build/ci/installer-smoke.ps1:PKCS8 private key:1766
/builds/hmailserver/hmailserver/build/generate-package-repos.py:PGP private key:375
# 14 October 2026, batch48's fold: deck-script-test.js's to 5288 (cp53's edits above it), read again;
# 15 October 2026, the help wiki link's twelve lines above it: to 5300, read again.
# 16 October 2026, batch48's fold-2b: the help list's reading of generate-help-pages.py and HelpPagesData.cpp
# (row A1's unit) under the wiki lines: to 5318, read again.
/builds/hmailserver/hmailserver/build/deck-script-test.js:PGP private key:5318
