From d769a3d8cb60e665a24b3fc8a802a6de7c24da4b Mon Sep 17 00:00:00 2001
From: "melodic-standards-sync[bot]"
 <300666570+melodic-standards-sync[bot]@users.noreply.github.com>
Date: Fri, 30 Oct 2026 21:42:21 +0000
Subject: [PATCH] chore: sync standards components
 (087158f34305187a2b76f9c643a8ff22b545fd94)

---
 .gitleaks.toml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitleaks.toml b/.gitleaks.toml
index 2ec95c9..f2f8cdd 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -18,8 +18,9 @@ useDefault = true
 # `github-app-token` rule stops at the `_` after the app id and the default
 # `jwt` rule's `\b` cannot match between `_` and `eyJ`. GitHub's recommended
 # regex: https://github.blog/changelog/2026-05-15-github-app-installation-tokens-per-request-override-header/
+# The leading `\b` keeps words that end in "ghs" (`highs_and_lows_...`) from matching.
 [[rules]]
 id = "github-app-installation-token"
 description = "GitHub App installation token, classic and stateless (ghs_<appid>_<jwt>) formats"
-regex = '''ghs_[A-Za-z0-9._-]{36,}'''
+regex = '''\bghs_[A-Za-z0-9._-]{36,}'''
 keywords = ["ghs_"]