diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..27db994
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,12 @@
+[allowlist]
+description = "Ignore test/demo secrets"
+paths = [
+  '''docs/.*''',
+  '''.*Test.*\.json''',
+  '''.*Development.*'''
+]
+
+regexes = [
+  '''FAKE_.*_KEY''',
+  '''TEST_.*_TOKEN'''
+]