# PQCrypta Discovery Agent — macOS Workstation preset
# For Mac laptops/desktops: Keychains on disk, MDM profiles, code-signing
# provisioning profiles, browser NSS databases, SSH/GnuPG, and developer/cloud
# tool credentials. The macOS Keychain is ALWAYS scanned natively via the
# Security framework in addition to these paths.
#
# Usage: pqcrypta-discovery --config macos-workstation.toml

api_url = "https://api.pqcrypta.com"
api_key = "YOUR-API-KEY-HERE"

# The built-in macOS defaults already resolve ~ for the running user and cover
# everything below. Keeping this empty is recommended for workstations; the
# list below shows what a narrowed scan looks like.
scan_paths = []
# scan_paths = [
#     # Keychains on disk
#     "/Library/Keychains/",
#     "~/Library/Keychains/",
#     # MDM / configuration profiles
#     "/var/db/ConfigurationProfiles/",
#     # Code signing / provisioning
#     "~/Library/MobileDevice/Provisioning Profiles/",
#     # Browsers / mail
#     "~/Library/Application Support/Firefox/Profiles/",
#     "~/Library/Thunderbird/",
#     "~/Library/Mail/",
#     # SSH / GnuPG
#     "/etc/ssh/",
#     "~/.ssh/",
#     "~/.gnupg/",
#     # Homebrew OpenSSL
#     "/opt/homebrew/etc/openssl/",
#     "/usr/local/etc/openssl/",
#     # Container / cloud tooling
#     "~/.docker/certs.d/",
#     "~/.kube/",
#     "~/.aws/",
#     "~/.azure/",
#     "~/.config/gcloud/",
#     # Package managers / build tools
#     "~/.m2/",
#     "~/.gradle/",
#     "~/.cargo/",
#     "~/.gem/",
# ]

excluded_paths = [
    "/private/tmp",
    "/dev",
    "/System/Volumes/Data/private/var/vm",
]

deep_scan = false

code_scan_paths = []
# Scan your local source checkouts for weak-crypto API calls (optional):
# code_scan_paths = ["~/dev"]
