From 3f61d103c2b07b58f0c3e256de14c0414c94b645 Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Thu, 8 Oct 2026 08:21:20 -0400 Subject: [PATCH 1/2] Mark Google's published reCAPTCHA test keys for secret scanners The test-key store and the live smoke test carry Google's documented always-pass reCAPTCHA pair. The value is the feature, so it stays, and each line now ends with ggignore and gitleaks:allow. The provider switching example in the docs used a key-shaped placeholder; it now reads example-key. --- CHANGELOG.md | 3 +++ docs/getting-started.md | 4 ++-- src/Credentials/TestKeyCredentialStore.php | 8 ++++---- tests/Feature/Live/ProviderSmokeTest.php | 4 ++-- 4 files changed, 11 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 05bafe7..1addb35 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -21,6 +21,9 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ### Changed +- Google's published reCAPTCHA test keys in `TestKeyCredentialStore`, and the live smoke test that + uses them, carry inline `ggignore` / `gitleaks:allow` markers so secret scanners stop reporting + them. The values and the production guard are unchanged. - The components render through `laranail/captcha::components.*`. `laranail-captcha::` still resolves the same files. - Docs, the README and the install command lead with the scoped tags and rule. diff --git a/docs/getting-started.md b/docs/getting-started.md index 33b8738..b4a0771 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -86,8 +86,8 @@ One line, and nothing in your forms changes: ```dotenv CAPTCHA_PROVIDER=turnstile -CAPTCHA_SITE_KEY=0x4AAA... -CAPTCHA_SECRET_KEY=0x4AAA... +CAPTCHA_SITE_KEY=example-key +CAPTCHA_SECRET_KEY=example-key ``` Forms bind to the canonical `captcha` field, and the widget writes it whichever provider is active. diff --git a/src/Credentials/TestKeyCredentialStore.php b/src/Credentials/TestKeyCredentialStore.php index 7fa9f25..b8647e5 100644 --- a/src/Credentials/TestKeyCredentialStore.php +++ b/src/Credentials/TestKeyCredentialStore.php @@ -46,12 +46,12 @@ 'secret' => '0x0000000000000000000000000000000000000000', ], 'recaptcha-v2' => [ - 'site_key' => '6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI', - 'secret' => '6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe', + 'site_key' => '6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI', // Google's published test key. ggignore gitleaks:allow + 'secret' => '6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe', // Google's published test key. ggignore gitleaks:allow ], 'recaptcha-v2-invisible' => [ - 'site_key' => '6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI', - 'secret' => '6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe', + 'site_key' => '6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI', // Google's published test key. ggignore gitleaks:allow + 'secret' => '6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe', // Google's published test key. ggignore gitleaks:allow ], ]; diff --git a/tests/Feature/Live/ProviderSmokeTest.php b/tests/Feature/Live/ProviderSmokeTest.php index 8323931..55ac6c4 100644 --- a/tests/Feature/Live/ProviderSmokeTest.php +++ b/tests/Feature/Live/ProviderSmokeTest.php @@ -87,8 +87,8 @@ function liveAdapter(Provider $provider, string $siteKey, string $secret): objec it('shows why the reCAPTCHA test keys are refused in production', function (): void { $adapter = liveAdapter( Provider::ReCaptchaV2, - '6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI', - '6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe', + '6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI', // Google's published test site key. ggignore gitleaks:allow + '6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe', // Google's published test secret. ggignore gitleaks:allow ); $result = $adapter->verify('not-a-real-token', VerificationContext::none()); From c2ac0c0cb533a268b57d44fbbf616a6db55b93c1 Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Thu, 8 Oct 2026 08:28:52 -0400 Subject: [PATCH 2/2] Leave the test-key store untouched Editing the lines that hold Google's published reCAPTCHA pair puts them in the pull request diff, and the GitGuardian GitHub App, which does not read inline markers, reports them there. The store keeps its existing ignored_matches entry in .gitguardian.yaml; the markers stay on the smoke test and the docs example. --- CHANGELOG.md | 3 --- src/Credentials/TestKeyCredentialStore.php | 8 ++++---- 2 files changed, 4 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1addb35..05bafe7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -21,9 +21,6 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ### Changed -- Google's published reCAPTCHA test keys in `TestKeyCredentialStore`, and the live smoke test that - uses them, carry inline `ggignore` / `gitleaks:allow` markers so secret scanners stop reporting - them. The values and the production guard are unchanged. - The components render through `laranail/captcha::components.*`. `laranail-captcha::` still resolves the same files. - Docs, the README and the install command lead with the scoped tags and rule. diff --git a/src/Credentials/TestKeyCredentialStore.php b/src/Credentials/TestKeyCredentialStore.php index b8647e5..7fa9f25 100644 --- a/src/Credentials/TestKeyCredentialStore.php +++ b/src/Credentials/TestKeyCredentialStore.php @@ -46,12 +46,12 @@ 'secret' => '0x0000000000000000000000000000000000000000', ], 'recaptcha-v2' => [ - 'site_key' => '6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI', // Google's published test key. ggignore gitleaks:allow - 'secret' => '6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe', // Google's published test key. ggignore gitleaks:allow + 'site_key' => '6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI', + 'secret' => '6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe', ], 'recaptcha-v2-invisible' => [ - 'site_key' => '6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI', // Google's published test key. ggignore gitleaks:allow - 'secret' => '6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe', // Google's published test key. ggignore gitleaks:allow + 'site_key' => '6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI', + 'secret' => '6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe', ], ];