GitGuardian: .gitleaks.toml allowlist regex quoting an Ada type name trips Generic High Entropy (false positive) #80

Finding

GitGuardian (app 46505) failed PR #76 with Generic High Entropy Secret at .gitleaks.toml:74, on commit 0d85728b17826fe8e761564d80efd8d75493734a.

Verdict: false positive. Line 74 is an anchored gitleaks allowlist regex, '''^…$''', that quotes an Ada type name from a signature type. The comment block above it already documents this as "SHAPE A": generic-api-key captured the type in a <Name> : <Type_Name>; parameter declaration. So one scanner's allowlist trips a second scanner, because the allowlist has to quote the text it suppresses.

Acceptance criteria

• Put a # ggignore comment on each allowlist line in .gitleaks.toml that quotes a high-entropy false-positive text. Alternatively, add a .gitguardian.yaml matches-ignore entry that names the same literal. Prefer the inline marker, because it stays next to the line it excuses.
• A PR touching .gitleaks.toml gets GitGuardian Security Checks: SUCCESS.
• gitleaks detect still reports 0 findings on the default branch. Prove the allowlist is still doing its job by removing it in a scratch run and confirming the findings come back.
• The owner resolves the matching GitGuardian dashboard incident as a false positive.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QYY8Gp4v4x2J7iSNn1vZ57