From f057648ce26bc9de522891393b367cb7be43f521 Mon Sep 17 00:00:00 2001
From: Charles Danesi <charles@charlesdanesi.net>
Date: Wed, 3 Jun 2026 18:16:54 -0400
Subject: [PATCH] ci: tighten gitleaks compose rules

---
 .gitleaks.toml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.gitleaks.toml b/.gitleaks.toml
index 0569cbd..7259ada 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -12,14 +12,14 @@ regexes = [
 [[rules]]
 id = "docker-env-password"
 description = "Hardcoded password in docker-compose environment"
-regex = '''(?i)(PASSWORD|PASS|PWD)\s*[:=]\s*['"]?([^$'{"][^\s'"]{5,})['"]?'''
+regex = '''(?i)(PASSWORD|PASS|PWD)\s*[:=]\s*['"]?([A-Za-z0-9!@#%^&+=.,_~/-]{8,})['"]?'''
 secretGroup = 2
 tags = ["docker", "compose", "password", "env"]
 
 [[rules]]
 id = "docker-env-secret"
 description = "Hardcoded secret, token, or API key in docker-compose environment"
-regex = '''(?i)(SECRET|TOKEN|API[_-]?KEY)\s*[:=]\s*['"]?([^$'{"][A-Za-z0-9_\-]{15,})['"]?'''
+regex = '''(?i)(SECRET|TOKEN|API[_-]?KEY)\s*[:=]\s*['"]?([A-Za-z0-9_\-]{20,})['"]?'''
 secretGroup = 2
 tags = ["docker", "compose", "secret", "env"]