From 4c9e42db75a7ff44f9c0c4495fc1d1eaafabc841 Mon Sep 17 00:00:00 2001
From: "n8n-cat-bot[bot]" <283985454+n8n-cat-bot[bot]@users.noreply.github.com>
Date: Mon, 15 Jun 2026 07:26:04 +0000
Subject: [PATCH] chore: Add Aikido scan configuration (no-changelog) (#32195)

Co-authored-by: n8n-cat-bot[bot] <n8n-cat-bot[bot]@users.noreply.github.com>
---
 .aikido | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 .aikido

diff --git a/.aikido b/.aikido
new file mode 100644
index 00000000000..1d1b6d78b0b
--- /dev/null
+++ b/.aikido
@@ -0,0 +1,21 @@
+# Aikido scan configuration
+# https://help.aikido.dev/code-scanning/scanning-practices/ignore-via-code-with-aikido-files
+# Path matching is plain substring against the full file path (no globs),
+# so fragment entries below act as suffix/segment wildcards.
+
+exclude:
+  paths:
+    # Machine-generated instance-AI expectation traces. Contain ephemeral
+    # credential reference IDs (nanoids) that re-trip the secrets scanner
+    # on every regeneration. No secret material.
+    - packages/testing/playwright/expectations
+
+    # Test code repo-wide. Fixtures routinely contain synthetic PEM blocks,
+    # basic-auth strings, and deliberately fake keys (including the secret
+    # scrubber's own tests). Verified 0/20 true-positive rate to date.
+    - .test.ts
+    - __tests__/
+    - /test/
+
+    # Test fixtures by convention.
+    - .fixture.ts