# Synthetic credential fixtures in the redaction test corpus.
#
# Every fingerprint below points into the redaction test corpus in
# tests/test_ssh.py -- the TestRedactSecrets* classes (TestRedactSecrets,
# TestRedactSecretsPerformance, TestRedactSecretsTokenwise,
# TestRedactSecretsNestedCredentialFlag). All but one are an INPUT to a test
# which asserts that _redact_secrets() replaces it; the curl-auth-user entry
# lands on a source comment naming the flags such a fixture exercises. They
# exist precisely so the redaction control has something to redact -- none is a
# real credential and none requires rotation. The published WHEEL excludes
# tests/ (hatchling packages src/ only) and .dockerignore excludes tests/, but
# the SDIST currently DOES ship tests/: pyproject.toml declares no
# [tool.hatch.build] target config, so hatchling's default sdist includes every
# non-gitignored path. Scanning the sdist surfaces these same fixtures.
#
# Recorded so a genuinely new finding is never lost in known noise. Generated
# from an actual `gitleaks git` run rather than by hand -- and the raw findings
# only reappear in such a run when this file is UNTRACKED (gitleaks reads the
# committed copy, so deleting it on disk alone still yields 0 findings).
# Re-generation is therefore APPEND-only: never replace the commit-pinned
# entries below with the output of a run made while they were in effect.
# Re-generate if the TestRedactSecrets* corpus is restructured.
#
# Scope limit: these fingerprints are commit-pinned (<sha>:<path>:<rule>:<line>)
# and so suppress nothing in a working-tree scan. `gitleaks dir` / `--no-git`
# reports the 7 below unsuppressed, plus untracked build/cache noise
# (tests/__pycache__/*.pyc, .pytest_cache/, gitignored docs/) -- all of it the
# same synthetic corpus, and all of it needing hand triage. Use `gitleaks git`
# for the pre-push gate.
#
# Per-entry line numbers are the coordinates AT THE PINNED COMMIT, not at HEAD;
# 6 of the 7 have since moved.

# tests/test_ssh.py:1322 (generic-api-key)
5093aca667d6aa461ea34e58a21b5d643b77e86a:tests/test_ssh.py:generic-api-key:1322

# tests/test_ssh.py:1327 (curl-auth-header)
5093aca667d6aa461ea34e58a21b5d643b77e86a:tests/test_ssh.py:curl-auth-header:1327

# tests/test_ssh.py:1424 (generic-api-key)
0bef32afb10f421075792663c21128d638ede7c4:tests/test_ssh.py:generic-api-key:1424

# tests/test_ssh.py:1426 (generic-api-key)
0bef32afb10f421075792663c21128d638ede7c4:tests/test_ssh.py:generic-api-key:1426

# tests/test_ssh.py:1437 (generic-api-key)
0bef32afb10f421075792663c21128d638ede7c4:tests/test_ssh.py:generic-api-key:1437

# tests/test_ssh.py:1438 (curl-auth-user)
0bef32afb10f421075792663c21128d638ede7c4:tests/test_ssh.py:curl-auth-user:1438

# tests/test_ssh.py:2058 (generic-api-key)
e09955c2be3c55dfd10d041e88c91569f65ba591:tests/test_ssh.py:generic-api-key:2058

# tests/test_ssh.py:2058 (generic-api-key) — same fixture as the e09955c entry
# above, re-pinned for the commit that actually landed on main.
#
# Appended 2026-09-06. `gitleaks git` over full history failed with exactly one
# finding: the entry above pins e09955c, which is NOT an ancestor of main --
# it survives only on origin/fix/p1-security-hardening, because PR #47 was
# squash-merged and the squash commit fde7222 got a different sha. The
# fingerprint's <sha> component therefore never matched a main-history scan.
#
# Both entries are kept deliberately, per the append-only rule above: e09955c
# still suppresses the finding when that branch is scanned, and fde7222 covers
# main. If origin/fix/p1-security-hardening is ever deleted the e09955c pin
# becomes inert, which is harmless -- do not prune it as "dead", because a pin
# that matches nothing costs one line and removing the wrong one reopens a
# known-noise finding.
#
# Verified synthetic before recording: the line is
# `_redact_secrets("cmd --password=<value> run")` in TestRedactSecretsTokenwise,
# an INPUT the test asserts gets replaced by {REDACTED}. Not a real credential,
# no rotation needed.
fde72221541c4928d209ccb8bd7163f590f82328:tests/test_ssh.py:generic-api-key:2058
