.gitleaksignore

# gitleaks baseline — historical findings that cannot be removed without
# rewriting shared `main` history. A real AWS account ID was committed in
# 0dca217 (two docs-backlog files + a diagram). The diagram is deleted from
# HEAD but the commit remains in history — keep all three fingerprints. See #313.
0dca2171f244f693ac7c649ecf376d1ce6af2b38:docs/backlog/EARLY_PROGRESS_MILESTONES.md:aws-account-id:5
0dca2171f244f693ac7c649ecf376d1ce6af2b38:docs/backlog/CLI_COGNITO_NEW_PASSWORD_CHALLENGE.md:aws-account-id:5
0dca2171f244f693ac7c649ecf376d1ce6af2b38:docs/diagrams/phase3-cedar-hitl.drawio:aws-account-id:28

# NOTE: the orch_abc_SUB-1 test-fixture false positive (formerly baselined here
# by commit-SHA fingerprint, #530) is now suppressed SHA-independently via a
# stopword allowlist in .gitleaks.toml — a commit-SHA fingerprint here broke when
# history was rewritten. See #537.

# Non-placeholder foreign-account fixtures in the already-pushed baa365fc
# test commit. HEAD uses the allowlisted AWS-published placeholder instead.
#
# BELT ONLY — the braces is the path-scoped `999988887777` allowlist in
# .gitleaks.toml, which is SHA-independent and is what actually keeps the
# per-PR range scan green across a rebase or squash of this branch. These two
# fingerprints are kept because they are more precise (two exact lines rather
# than a value pattern) while the branch is open, and they are the FIRST thing to
# delete once #733 merges: at that point they are either dead (squash-merge, the
# blob never reaches main) or redundant with the .gitleaks.toml block.
#
# Do not add a fingerprint here WITHOUT its SHA-independent counterpart — that is
# the exact #537 regression the note above describes.
baa365fc4137fee701bd7655b3255c0755adcb57:agent/tests/test_server.py:aws-account-id:2087
baa365fc4137fee701bd7655b3255c0755adcb57:agent/tests/test_server.py:aws-account-id:2118