When suppressing secret-scan findings (e.g., via gitleaks allowlists), keep exemptions narrowly scoped and verify the suppression boundaries. Use specific rule types and matching criteria (e.g., condition + regexTarget) rather than broad path-based ignores, and confirm that only the intended false positives are ignored while unrelated credentials at the same location are still detected.
Example (gitleaks-style allowlist):
[extend]
useDefault = true
[[allowlists]]
# Suppress only the intended generic API-key false positives
# with an explicit match target and strict condition.
# (Tune regexTarget/condition to your false-positive pattern.)
title = "Cline SDK secret scanning"
# Example shape:
# - condition: ensure both criteria must match
# - regexTarget: ensure matching is anchored to the expected field/value form
# (Keep this narrowly defined.)
# condition = "AND"
# regexTarget = "match"
# model = "<only intended synthetic IDs>" # or equivalent precise selector
Verification checklist: