[extend]
useDefault = true

[allowlist]
description = "Reviewed false positives: inventory SHA-256, PEM serialization code, public login userKey"
condition = "AND"
paths = [
  '^docs/evidence/original-source-manifest\.json$',
  '^src/main/webapp/plug-in/jsencrypt/jsencrypt\.min\.js$',
  '^src/main/java/com/zzc/app/login/UserLoginController\.java$',
]
regexTarget = "match"
regexes = [
  '["\s:]+[0-9a-f]{64}',
  'getPrivateBaseKeyB64\(\)',
  'key = "[0-9a-f]{32}"',
]