From 4dd911c0c41d72ad8b6ee65b2af0bf9ca735b347 Mon Sep 17 00:00:00 2001
From: AnassNaouchi <anas.n@opn.ooo>
Date: Mon, 7 Sep 2026 05:46:40 +0300
Subject: [PATCH 1/2] Protect production urls from manipulation

---
 .github/copilot-instructions.md    | 42 ++++++++++++++++++++++++++++++
 .gitleaks.toml                     | 33 +++++++++++++++++++++++
 .pre-commit-config.yaml            | 12 +++++++++
 omise/test/test_production_urls.py |  9 +++++++
 4 files changed, 96 insertions(+)
 create mode 100644 .github/copilot-instructions.md
 create mode 100644 .gitleaks.toml
 create mode 100644 .pre-commit-config.yaml
 create mode 100644 omise/test/test_production_urls.py

diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
new file mode 100644
index 0000000..019210d
--- /dev/null
+++ b/.github/copilot-instructions.md
@@ -0,0 +1,42 @@
+# Omise Python SDK — Security & Code Review Instructions
+
+## Code Review Checklist
+
+When reviewing PRs or commits, Copilot should automatically flag:
+
+### 1. Non-Production Omise Hosts (CRITICAL)
+
+Flag any committed code containing Omise domains that do NOT match the official
+production domain pattern `*.omise.co`. This includes:
+
+- Omise domains with any prefix other than `api`, `vault`, or other official production services
+- Any `localhost` or `internal` patterns referencing Omise
+- Any non-production environment hosts
+
+## Critical Files Requiring Strict Review
+
+These files contain Omise endpoint/host constants and require additional scrutiny:
+
+### `omise/__init__.py` — CRITICAL SECURITY FILE
+
+This file defines the base URLs used throughout the Omise Python SDK for API
+and vault calls. It contains the production endpoint constants.
+
+**Changes to Block (Red Flag):**
+
+- Any change introducing a non-omise.co domain for production endpoints
+- Hardcoding non-production Omise URLs in production code paths (regex: `https?://[a-zA-Z0-9.-]*omise[a-zA-Z0-9.-]*(?<!omise\.co)`)
+- Changing `api_main` or `api_vault` to anything other than the official production domains:
+	- `https://api.omise.co`
+	- `https://vault.omise.co`
+
+**Changes Requiring Manual Review (Yellow Flag):**
+
+- Any modification to `api_main` or `api_vault`
+- Changes to `_MainResource._request()`, `_VaultResource._request()`, or `_PublicResource._request()` that alter API or vault base URL selection
+- Introduction of new environment types or URL patterns
+
+**Allowed Modifications:**
+
+- Adding validation or documentation about URL formats
+- Refactoring method structure without changing returned URLs
\ No newline at end of file
diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..9c502a1
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,33 @@
+title = "Omise Python Gitleaks configuration"
+
+[extend]
+useDefault = true
+
+[[rules]]
+id = "non-production-omise-host"
+description = "Non-production Omise host"
+regex = '''https?://([A-Za-z0-9.-]*omise[A-Za-z0-9.-]*)'''
+secretGroup = 1
+
+  [[rules.allowlists]]
+  description = "Official Omise hosts"
+  regexes = [
+    '''^([A-Za-z0-9-]+\.)*omise\.co$''',
+  ]
+
+[[allowlists]]
+description = "Ignored generated files"
+paths = [
+  '''^\.tox/''',
+  '''^build/''',
+  '''^omise\.egg-info/''',
+  '''(^|/)__pycache__/''',
+  '''\.pyc$''',
+]
+
+[[allowlists]]
+description = "Ignore test tokens and mock credentials"
+regexTarget = "match"
+regexes = [
+  '''(?:skey|pkey|tokn)_test_[a-zA-Z0-9]+''',
+]
\ No newline at end of file
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..11fee66
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,12 @@
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.1
+    hooks:
+      - id: gitleaks
+        name: "gitleaks - Detect secrets and non-production Omise hosts"
+        description: "Detect secrets and non-production Omise hosts using gitleaks"
+        entry: gitleaks detect --verbose --redact --no-git --source . --config .gitleaks.toml
+        language: golang
+        stages: [pre-commit]
+        always_run: true
+        pass_filenames: false
\ No newline at end of file
diff --git a/omise/test/test_production_urls.py b/omise/test/test_production_urls.py
new file mode 100644
index 0000000..ddaee93
--- /dev/null
+++ b/omise/test/test_production_urls.py
@@ -0,0 +1,9 @@
+import unittest
+
+import omise
+
+
+class ProductionUrlsTest(unittest.TestCase):
+    def test_api_urls_match_production_endpoints(self):
+        self.assertEqual(omise.api_main, 'https://api.omise.co')
+        self.assertEqual(omise.api_vault, 'https://vault.omise.co')
\ No newline at end of file

From 8778a31eb4c34a957d8d94a1862d24f3930511fc Mon Sep 17 00:00:00 2001
From: AnassNaouchi <anas.n@opn.ooo>
Date: Wed, 9 Sep 2026 05:56:35 +0300
Subject: [PATCH 2/2] Modify regex to scan both domain and full url for api
 scans and set gitleaks scan to local system

---
 .github/copilot-instructions.md | 2 +-
 .gitleaks.toml                  | 2 +-
 .pre-commit-config.yaml         | 5 ++---
 3 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index 019210d..7e9acef 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -24,7 +24,7 @@ and vault calls. It contains the production endpoint constants.
 
 **Changes to Block (Red Flag):**
 
-- Any change introducing a non-omise.co domain for production endpoints
+- Any change introducing a non omise.co domain for production endpoints
 - Hardcoding non-production Omise URLs in production code paths (regex: `https?://[a-zA-Z0-9.-]*omise[a-zA-Z0-9.-]*(?<!omise\.co)`)
 - Changing `api_main` or `api_vault` to anything other than the official production domains:
 	- `https://api.omise.co`
diff --git a/.gitleaks.toml b/.gitleaks.toml
index 9c502a1..cd8434e 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -6,7 +6,7 @@ useDefault = true
 [[rules]]
 id = "non-production-omise-host"
 description = "Non-production Omise host"
-regex = '''https?://([A-Za-z0-9.-]*omise[A-Za-z0-9.-]*)'''
+regex = '''(?:https?://)?((?:\b[a-zA-Z0-9-]+\.)*[a-zA-Z0-9-]*omise[a-zA-Z0-9-]*\.co)'''
 secretGroup = 1
 
   [[rules.allowlists]]
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 11fee66..f560e4d 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,12 +1,11 @@
 repos:
-  - repo: https://github.com/gitleaks/gitleaks
-    rev: v8.30.1
+  - repo: local
     hooks:
       - id: gitleaks
         name: "gitleaks - Detect secrets and non-production Omise hosts"
         description: "Detect secrets and non-production Omise hosts using gitleaks"
         entry: gitleaks detect --verbose --redact --no-git --source . --config .gitleaks.toml
-        language: golang
+        language: system
         stages: [pre-commit]
         always_run: true
         pass_filenames: false
\ No newline at end of file