# Credential-shaped strings that are allowed to be in this repository.
#
# The "No committed credentials" job in ci.yml greps the tree for anything shaped like a live key
# and fails the build on a hit. The docs and the e2e fixtures legitimately need a few — you cannot
# test that a shop can connect and then disconnect Slack without a Slack-shaped token — so this
# file is the exception list.
#
# It is exact literals, not a "looks fake to me" heuristic, and that is the point: a real key can
# never accidentally match a line nobody wrote, and admitting a new placeholder stays a deliberate
# edit that shows up in review. The job also fails if a line here no longer appears anywhere in the
# tree, so the list cannot rot into a permanent hole in the scan.
#
# One exact string per line. Blank lines and # comments are ignored.
#
# Before you add a line: if you are adding it because a real key tripped the scan, the answer is to
# remove the key and rotate it, never to list it here.

# bin/gate-e2e.mjs — a shop connects Slack, saves the form blank, then disconnects it. The token is
# never sent anywhere; the assertions are about slack_bot_token_set flipping true and back to false.
xoxb-0000-EXAMPLE-NOT-A-REAL-TOKEN
