Select the risk class and toolchain. The output stays generic by design: placeholders mark the client-specific patterns that belong in a private onboarding step.
▮[ §A · CONFIG BUILDER ]
Pick the boundary before writing the regex.
.gitleaks.toml
title = "regulated-leak-boundary-template"
# Generated for: Pharma
# Toolchain: GitHub, Claude
# Replace placeholders during client onboarding.
# {{EMPLOYER_NAME}}
# {{INTERNAL_PROJECT_PATTERN}}
[allowlist]
description = "Public documentation examples only."
paths = [
'''docs/examples/.*''',
]
[[rules]]
id = "regulated-placeholder-1"
description = "Replace {{BATCH_OR_LOT_PATTERN}} with a client-approved regex before use."
regex = '''{{BATCH_OR_LOT_PATTERN}}'''
tags = ["regulated", "placeholder", "pharma"]
[[rules]]
id = "regulated-placeholder-2"
description = "Replace {{SOP_ID_PATTERN}} with a client-approved regex before use."
regex = '''{{SOP_ID_PATTERN}}'''
tags = ["regulated", "placeholder", "pharma"]
[[rules]]
id = "regulated-placeholder-3"
description = "Replace {{EQUIPMENT_ID_PATTERN}} with a client-approved regex before use."
regex = '''{{EQUIPMENT_ID_PATTERN}}'''
tags = ["regulated", "placeholder", "pharma"]
[[rules]]
id = "regulated-placeholder-4"
description = "Replace {{CUSTOMER_PROTOCOL_PATTERN}} with a client-approved regex before use."
regex = '''{{CUSTOMER_PROTOCOL_PATTERN}}'''
tags = ["regulated", "placeholder", "pharma"]
preflight.sh
#!/usr/bin/env bash
set -euo pipefail
echo "preflight: regulated workspace"
echo "scope: Pharma"
test -f .gitleaks.toml
test -d docs
test -d app
echo "privacy boundary"
test -f .gitignore
grep -q "{{PRIVATE_CONTENT_DIR}}" .gitignore
echo "toolchain checks"
echo " - GitHub: protected main branch"
echo " - GitHub: secret scan before push"
echo " - GitHub: pull-request audit note"
echo " - Claude: prompt-boundary note"
echo " - Claude: no raw client identifiers"
echo " - Claude: human review required"
echo "placeholder review"
echo " - replace {{EMPLOYER_NAME}} during onboarding"
echo " - replace {{INTERNAL_PROJECT_PATTERN}} during onboarding"
echo " - replace {{PRIVATE_CONTENT_DIR}} during onboarding"
echo "preflight: PASS"