fix(security): stop Gitleaks allowlist from suppressing real localhos…

[lemarjohnny781]

…t credentials

The global [allowlist].regexes list contained bare, unanchored localhost, 127.0.0.1 and example.com patterns. Gitleaks matches allowlist regexes against the finding's secret, so any finding merely containing one of those substrings was suppressed -- including a genuine leak such as postgres://user:RealLeakedPassword@localhost:5432/db.

Replace all three with a single anchored (^...$) pattern that matches only a complete connection string whose password is a well-known placeholder token (password, changeme, postgres, your_password, xxx, ...) on a loopback or example.* host. It can therefore only ever suppress a non-secret: a real credential on localhost is now reported, and a placeholder password on a real host (postgres://postgres:postgres@prod-db.internal:5432/db) still is too.

Two supporting rule fixes were required to make this work:

• postgres(ql)? -> postgres(?:ql)?. Gitleaks reports capture group 1 as the finding's secret, so postgresql:// URLs reported a secret of literally ql while postgres:// URLs reported the full match. The allowlist was thus unreachable for the former and over-broad for the latter. This also clears two long-standing false positives on the CI placeholder DSN in .github/workflows/performance.yml.
• Broaden the password character class from [a-zA-Z0-9_-] to accept punctuation, since real passwords contain it and ...Password123!@localhost previously did not match the rule at all. $ < > { } are excluded so shell and Terraform interpolations are not reported as leaks.

Verified with gitleaks 8.30.1:

• 15-case fixture: all 8 real-credential cases flagged, all 7 placeholder cases allowlisted.
• Working tree: 12 findings -> 10, zero new findings; the 2 removed are the performance.yml false positives.
• Full history (483 commits): 361 -> 357, zero new findings.
• Scratch file with postgres://user:RealLeakedPassword123!@localhost:5432/db is flagged; postgres://user:password@localhost:5432/db is allowlisted.

Description

Type of Change

• Bug fix
• New feature
• Refactor / code cleanup
• Documentation update
• CI / tooling change
• Breaking change

Testing Done

Bundle Size

Chunk	Before	After
vendor.js
main*.js
pages/_app*.js

Checklist

• Tests pass locally
• Documentation updated (if applicable)
• No breaking changes, or breaking changes are documented above
• If you added or changed an API endpoint, regenerated the OpenAPI spec and committed the result:

  cd services/api && cargo run --bin generate-openapi > openapi.yaml
  git add openapi.yaml && git commit -m "chore: regenerate openapi.yaml"

• If you changed system architecture (new service, database, external dependency, or network boundary), updated docs/architecture.md
• Bundle size checked (if frontend changes)

Related Issues

Closes #1217

[drips-wave]

@lemarjohnny781 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits