diff --git a/.github/.gitleaks.toml b/.github/.gitleaks.toml
new file mode 100644
index 000000000..68ca574d6
--- /dev/null
+++ b/.github/.gitleaks.toml
@@ -0,0 +1,3 @@
+[allowlist]
+description = "ignore enteprise-attack.json since it has false positives due to Twitter IDs"
+paths = ['''salt/nginx/files/enterprise-attack.json''']