data_extensions:
  - .github/codeql/extensions/safeLog.model.yml

query-filters:
  # API tokens are 256-bit CSPRNG random; sha256 of the raw token is the
  # correct construction. js/insufficient-password-hash exists to catch weak
  # hashing of low-entropy human passwords, which is irrelevant for these
  # high-entropy opaque keys. Scoped to the token-handling files only, so
  # real user-password code (bcrypt-hashed elsewhere) is still analyzed.
  - exclude:
      id: js/insufficient-password-hash
      paths:
        - backend/src/utils/apiTokenFormat.ts
        - backend/src/routes/apiTokens.ts
        - backend/src/__tests__/**
  # End-to-end fixtures seed files directly into the backend's COMPOSE_DIR so
  # the API under test can read them back. Both the test runner and the backend
  # use a fixed path under /tmp (the spec fallback and the CI start-app default
  # are both /tmp/compose), so CodeQL flags the hardcoded literal as
  # js/insecure-temporary-file. A randomized mkdtemp does not apply here: the
  # backend resolves paths against its own COMPOSE_DIR, so a fixture written
  # elsewhere would be invisible to it. The predictable-temp-path threat is also
  # moot on the ephemeral, single-tenant machines these specs run on.
  # Scoped to e2e/** so production code is still analyzed.
  - exclude:
      id: js/insecure-temporary-file
      paths:
        - e2e/**