Exclude wp-admin and wp-includes in gitleaks.toml file

Ahmad Yazbek

I am trying to exclude the WordPress files wp-includes and wp-admin in gitleaks.toml to avoid unnecessary checks and errors. I am trying to include the two files paths like this :
paths = [

'''app/public/wp-admin/.*''',

'''app/public/wp-includes/.*'''
] 

and I tried this path also: 
path=[

'''^app/public/wp-admin/.*''',

'''^app/public/wp-includes/.*''',

]

but the results are the same. The folders are being scanned. 

Any suggestions?

Igor Stoyanov

Hi @Ahmad Yazbek . Please, check the docs.
You should add paths under [allowlist] section.
Example:

# This is a global allowlist which has a higher order of precedence than rule-specific allowlists.
# If a commit listed in the `commits` field below is encountered then that commit will be skipped and no
# secrets will be detected for said commit. The same logic applies for regexes and paths.
[allowlist]
description = "global allow list"
commits = [ "commit-A", "commit-B", "commit-C"]
paths = [
  '''gitleaks\.toml''',
  '''(.*?)(jpg|gif|doc)'''
]

Regards, Igor