['index.php', 'api.php', 'schema.sql', 'README.md', 'inc', 'pages', 'cron', 'docs', 'assets/app.js', 'assets/style.css'], /* Refused always: credentials and their template, data, logs, the admin console (the write path, not part of how any published number is produced), the server diagnostic. */ 'never' => ['config.php', 'config.sample.php', 'data', 'logs', 'admin', 'diagnose.php', 'install.php', '.env', '.htaccess', 'inc/snapshots'], /* File-name patterns skipped inside included directories: editors' backups and the snapshots themselves. */ 'skip_patterns' => ['/\.before-[a-z0-9-]+$/', '/~$/', '/\.bak$/', '/\.orig$/', '/^\./'], 'extensions' => ['php', 'js', 'css', 'sql', 'md', 'txt', 'json'], 'max_file_bytes' => 1000000, /* Addresses that may appear (the company's own); every other e-mail address is redacted at snapshot time. */ 'allowed_email_domains' => ['districthive.com'], /* Strings that must never appear in a shown file: the deploy is refused if one is found. The values of the configuration's own constants (database name and user, passwords, hashes, keys, tokens, hosts) are checked as well, read from config.php at snapshot time and never written anywhere. */ 'forbidden_strings' => ['BEGIN PRIVATE KEY', 'BEGIN RSA', 'BEGIN OPENSSH', 'sk-ant-'], 'config_constant_pattern' => '/(PASS|SECRET|KEY|TOKEN|HASH|SALT|DB_NAME|DB_USER|DB_HOST|_HOST|CLIENT)$/', ];