# PeerCortex pre-push scan allowlist — reviewed false positives (2026-07-16).
# ERE, one pattern per line, matched case-insensitively against flagged content.
# See ~/.claude/hooks/lib/security-scan-core.sh for how this file is applied.
# Keep this NARROW — the scanner's philosophy is "block too often rather than
# too little"; only add a pattern here after actually confirming it's not a leak.

# Own product name / own repo / own deploy path — self-references, not leaked infra.
PeerCortex
/opt/peercortex-app
peercortex\.org
gitea\.context-x\.org/rene/PeerCortex

# Own maintainer contact, intentionally public (User-Agent strings, package.json author).
rene\.fichtmueller@flexoptix\.net

# RFC 5735 / RFC 6890 bogon-range constants used by the Network Health Report's
# bogon-detection check (server.js `bogonV4`) — standardized documentation/private
# ranges hardcoded as comparison targets, not leaked infrastructure addresses.
net: "0\.0\.0\.0"
net: "10\.0\.0\.0"
net: "100\.64\.0\.0"
net: "127\.0\.0\.0"
net: "169\.254\.0\.0"
net: "172\.16\.0\.0"
net: "192\.0\.2\.0"
net: "192\.168\.0\.0"
net: "198\.51\.100\.0"
net: "203\.0\.113\.0"
net: "240\.0\.0\.0"

# Rene's home-network default fallback for local Postgres dev (DB_HOST env default
# in bgp-hijack-monitor.js, local-db-client.js, magatama-s2ten-bgp-enrichment.js).
# LAN-only address, no credentials attached, already reviewed as non-sensitive.
192\.168\.178\.82