From 75ef9bfd64e43674138115971532b7253e876414 Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Wed, 17 Dec 2025 13:40:07 -0500
Subject: [PATCH] Add a gitleaks rule to find hex strings in URLs

but allow things that look like Github SHAs.
---
 .gitleaks.toml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.gitleaks.toml b/.gitleaks.toml
index 4a1991496..ead929762 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -9,3 +9,11 @@ paths = [
   '''docs/''',
   '''test/''',
 ]
+
+[[rules]]
+id = "basecamp-integration-url"
+description = "Basecamp Integration URL"
+regex = '''https://[^\s]*?([0-9a-fA-F]{16,})'''
+[rules.allowlist]
+regexTarget = "match"
+regexes = ['''github\.com''']