diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 000000000..22fa6d1fb
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,52 @@
+# Gitleaks-konfiguration för accounted.
+#
+# Utökar gitleaks standardregler och allowlistar verifierade falska positiver:
+# kodexempel i dokumentation, testfixtures, publika register (t.ex. AAGUID) och
+# .env-exempel. Varje post är granskad mot filens innehåll — inga riktiga
+# hemligheter. Filspecifika poster så att verkliga hemligheter i andra filer fälls.
+
+[extend]
+useDefault = true
+
+[[allowlists]]
+description = "Verifierade falska positiver per fil (se kommentar ovan)"
+paths = [
+  '''^\.claude/skills/gdpr-cicd-compliance/SKILL\.md$''',
+  '''^app/\(auth\)/auth/callback/__tests__/route\.test\.ts$''',
+  '''^app/\(auth\)/reset-password/__tests__/invite-handoff\.test\.ts$''',
+  '''^app/api/v1/companies/\[companyId\]/customers/__tests__/route\.test\.ts$''',
+  '''^app/api/v1/companies/\[companyId\]/customers/bulk-create/__tests__/route\.test\.ts$''',
+  '''^app/api/v1/companies/\[companyId\]/invoices/\[id\]/credit/__tests__/route\.test\.ts$''',
+  '''^app/api/v1/companies/\[companyId\]/invoices/\[id\]/mark-paid/__tests__/route\.test\.ts$''',
+  '''^app/api/v1/companies/\[companyId\]/invoices/\[id\]/mark-sent/__tests__/route\.test\.ts$''',
+  '''^app/api/v1/companies/\[companyId\]/invoices/\[id\]/send/__tests__/route\.test\.ts$''',
+  '''^app/api/v1/companies/\[companyId\]/invoices/__tests__/route\.test\.ts$''',
+  '''^app/api/v1/companies/\[companyId\]/invoices/bulk-create/__tests__/route\.test\.ts$''',
+  '''^app/api/v1/companies/\[companyId\]/reconciliation/bank/__tests__/route\.test\.ts$''',
+  '''^app/api/v1/companies/\[companyId\]/settings/__tests__/route\.test\.ts$''',
+  '''^app/api/v1/companies/\[companyId\]/supplier-invoices/\[id\]/mark-paid/__tests__/route\.test\.ts$''',
+  '''^app/api/v1/companies/\[companyId\]/transactions/\[id\]/__tests__/route\.test\.ts$''',
+  '''^app/api/v1/companies/\[companyId\]/transactions/\[id\]/categorize/__tests__/route\.test\.ts$''',
+  '''^app/api/v1/companies/\[companyId\]/transactions/\[id\]/match-invoice/__tests__/route\.test\.ts$''',
+  '''^app/api/v1/companies/\[companyId\]/transactions/\[id\]/match-supplier-invoice/__tests__/route\.test\.ts$''',
+  '''^app/api/v1/companies/\[companyId\]/transactions/batch-categorize/__tests__/route\.test\.ts$''',
+  '''^app/api/v1/companies/\[companyId\]/transactions/ingest/__tests__/route\.test\.ts$''',
+  '''^app/invite/\[token\]/__tests__/invite-cookie\.test\.ts$''',
+  '''^dev_docs/ENABLE_BANKING_DOCS/API_EB\.md$''',
+  '''^extensions/general/arcim-migration/__tests__/bl-lundify-activation\.test\.ts$''',
+  '''^extensions/general/mcp-server/__tests__/create-customer\.test\.ts$''',
+  '''^extensions/general/mcp-server/__tests__/update-customer\.test\.ts$''',
+  '''^extensions/general/stripe/__tests__/payment-links\.test\.ts$''',
+  '''^lib/auth/__tests__/consume-invite-cookie\.test\.ts$''',
+  '''^lib/docs/content/cookbook/file-vat-declaration\.ts$''',
+  '''^lib/docs/content/cookbook/ingest-bank-transactions\.ts$''',
+  '''^lib/docs/content/cookbook/quickstart\.ts$''',
+  '''^lib/docs/content/cookbook/run-payroll-and-agi\.ts$''',
+  '''^lib/docs/content/cookbook/webhooks\.ts$''',
+  '''^lib/docs/content/cookbook/year-end-closing\.ts$''',
+  '''^lib/docs/content/landing\.ts$''',
+  '''^lib/providers/bjornlunden/__tests__/activation\.test\.ts$''',
+  '''^lib/reports/catalog\.ts$''',
+  '''^scripts/api-skill/overlays/quickstart\.md$''',
+  '''^skills/accounted-api/SKILL\.md$''',
+]