.gitmodules

# gitleaks-v8.30.1 sha256:6b2638a733b85619dc80bdf28e84e4fed7e526a761ab5c148fbf67695aea2115
[submodule "upstream/gitleaks"]
	ref = 83d9cd684c87d95d656c1458ef04895a7f1cbd8e
	path = upstream/gitleaks
	url = https://github.com/gitleaks/gitleaks.git
	branch = v8.30.1
	shallow = true
	ignore = dirty
	sparse-checkout = config testdata/config
	verify = none
# zizmor-v1.30.1 (2026-09-09) sha256:32e54fb73f6172bd53194d25b9270dcd7abe0a44daa97999f000a2d2c8fb9f5c
[submodule "upstream/zizmor"]
	ref = 99a054ed9283c90abdd2d5b9fb5101d27dde9783
	path = upstream/zizmor
	url = https://github.com/zizmorcore/zizmor.git
	branch = v1.30.1
	shallow = true
	ignore = dirty
	sparse-checkout = docs crates/zizmor/tests
	verify = none
# trivy-v0.74.0 (2026-08-14) sha256:285594b257470eb444fd2836be95a835565ee600382320c977b3993d8efbb767
[submodule "upstream/trivy"]
	ref = e1fd17a0ea4a8cf24bc4b4dd7e2cfbf4bb31b994
	path = upstream/trivy
	url = https://github.com/aquasecurity/trivy.git
	branch = v0.74.0
	shallow = true
	ignore = dirty
	sparse-checkout = pkg/fanal/secret
	verify = none
# codex-security-npm-v0.1.30 (2026-09-23) sha256:cd7d609a80fd4820c036871038ced979f87ece152ff6938c763c5ff545a6602d
[submodule "upstream/codex-security"]
	ref = 6eecd8ca2587fe44d3b971026d32d591b5ecd315
	path = upstream/codex-security
	url = https://github.com/openai/codex-security.git
	branch = npm-v0.1.30
	shallow = true
	ignore = dirty
	sparse-checkout = plugins/codex-security/preflight plugins/codex-security/schemas plugins/codex-security/skills
	verify = none
# agentshield-v1.6.0 (2026-09-10) sha256:c4e61fe7677fd7cdff9616ec0d1b167ab5c003ca16b6ac85c2f085a6470564c2
[submodule "upstream/agentshield"]
	ref = b0891303bdcd6037376a94263d45cfd2ff3dfb98
	path = upstream/agentshield
	url = https://github.com/affaan-m/agentshield.git
	branch = v1.6.0
	shallow = true
	ignore = dirty
	sparse-checkout = src
	verify = none
# 🚨 AGPL-3.0 — CLEAN-ROOM, TESTS-ONLY. TruffleHog is pinned SOLELY as a
# coverage-comparison oracle, and its IMPLEMENTATION IS UNREADABLE BY
# CONSTRUCTION, not merely un-copied.
#
# The sparse-checkout admits ONLY `*_test.go` files and `testdata/` fixtures
# under pkg/detectors, in NO-CONE mode (cone mode cannot express a file-level
# glob, so `sparse-mode = no-cone` is load-bearing — materialize via
# `node scripts/repo/materialize-upstream.mts trufflehog`, never a bare cone
# clone). Not one line of TruffleHog implementation lands on disk, so no agent
# and no human can read it. Absence is the block.
#
# The oracle infers detector families from test FILE PATHS only — the fact that
# `pkg/detectors/stripe/stripe_test.go` exists tells us a Stripe detector
# exists. It never reads a registry or an implementation file. There is NO
# trufflehog generator and NO trufflehog-derived table row, ever. Their bytes
# are never vendored into our tree; conformance reads the pinned submodule.
#
# For secret detection, gitleaks (MIT) is the sanctioned derivation source.
# Guard: .claude/hooks/repo/no-copyleft-source-read/
# Gate:  scripts/repo/check/copyleft-slices-are-tests-only.mts
# See docs/agents.md/repo/upstream-slices.md and NOTICE.
# trufflehog-v3.97.8 (2026-09-23) sha256:f8a42aae80a65bb7e64d54ba8184c7cbd9f9ade8ae48acd02afd834828495f82
[submodule "upstream/trufflehog"]
	ref = a5f3de55cc2065ae4dde8fee24076f137fd62fcf
	path = upstream/trufflehog
	url = https://github.com/trufflesecurity/trufflehog.git
	branch = v3.97.8
	shallow = true
	ignore = dirty
	sparse-checkout = **/*_test.go **/testdata/** /AUTHORS* /CONTRIBUTORS* /COPYING* /LICENSE* /NOTICE* /README*
	verify = none
	sparse-mode = no-cone
# skillspector-v2.11.2 (2026-09-09) sha256:a8f5d57ad1be3164c3a8e890e262f26b98a2133dd9251539b22fa992797747a0
[submodule "upstream/skillspector"]
	ref = 69dcdfb74487d361ba4c811d088cfdea2ff3a9dc
	path = upstream/skillspector
	url = https://github.com/NVIDIA/SkillSpector.git
	branch = v2.11.2
	shallow = true
	ignore = dirty
	sparse-checkout = src/skillspector/nodes/analyzers
	verify = none