chore: import verified syly2 maintenance baseline without embedded credentials

2026-10-29 22:22:49 +08:00
commit da8224efd8
5265 changed files with 1199963 additions and 0 deletions
@@ -0,0 +1,17 @@
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Reviewed false positives: inventory SHA-256, PEM serialization code, public login userKey"
+condition = "AND"
+paths = [
+  '^docs/evidence/original-source-manifest\.json$',
+  '^src/main/webapp/plug-in/jsencrypt/jsencrypt\.min\.js$',
+  '^src/main/java/com/zzc/app/login/UserLoginController\.java$',
+]
+regexTarget = "match"
+regexes = [
+  '["\s:]+[0-9a-f]{64}',
+  'getPrivateBaseKeyB64\(\)',
+  'key = "[0-9a-f]{32}"',
+]