docs: add false.md, a curated log of known false positives

ober

8fa17ec3704db05a8212da611b09f412c9e65a93

diff --git a/false.md b/false.md
new file mode 100644
index 0000000..41b66f2
--- /dev/null
+++ b/false.md
@@ -0,0 +1,63 @@
+# Known false positives
+
+A log of strings gitsafe has flagged that are *not* secrets. Each
+entry should say where the string was seen, why it's safe, and what
+(if anything) we did about it.
+
+This is purely a reference document — gitsafe does not read it. The
+actual exclusion lives in `gitsafe.json` (project-local) or the
+`allowlist.patterns` array.
+
+---
+
+## 2026-05-15 — `jerboa-pgp/docs/FORMATS.md`
+
+Adding long-form documentation that includes example identity files,
+`jpgp1` pubkey lines, signature blobs, and age armor. Ten findings,
+all in one file. Resolved by adding `.gitsafe.json` to jerboa-pgp with
+`exclude: ["**/*.md", "docs/**"]`.
+
+### Reproduction
+
+```
+gitsafe pre-commit
+```
+
+run against `docs/FORMATS.md`.
+
+### Findings
+
+| Line | Match (prefix…suffix)        | Why it's safe                                                  |
+|-----:|------------------------------|----------------------------------------------------------------|
+| 22   | `YWdl…ZGdL`                  | Base64-decodes to `age-encryption.org/v1\n-> scrypt e4zDnseLm7TrdgK` — a truncated, illustrative age armor header demonstrating what an encrypted file looks like. No key material. |
+| 31   | `AGE-SECRET-KEY-1QQPYHL45Z3M9LRMV43LXMW9F8L65EXPK0XNVTU2LJV30Q66NXFHSNAFV4R` | An illustrative age secret key in the documented bech32 format. **Not a real key** — generated for documentation. Decodes to a valid X25519 scalar but corresponds to no identity used anywhere. |
+| 32   | `age1ydnymp4uvyfu46c3yph46m4qvfh4d8a8ssvw48tdpwwa2q72txuqz0fc8h` | Illustrative age public key paired with the secret key above. Public keys are not secrets anyway. |
+| 33   | `dGVz…MzM=`                  | Base64-decodes to `test-secret-key-bytes-32-chars-long233`. Obviously fake placeholder for "this is where the Ed25519 secret seed would go". |
+| 34   | `dGVz…MjI=`                  | Base64-decodes to `test-public-key-bytes-32-chars-long222`. Public-key counterpart of the above; not a secret in any case. |
+| 63   | `age1ydn…fc8h` (inside `jpgp1` line) | Same illustrative age pubkey as line 32, embedded in an example `jpgp1` public-key line. |
+| 106  | `9p+rmTm5C3uxLXKsxbCnPGsf1Bk6XdQB5Wg3KxV3iE0` | An illustrative SHA-256 fingerprint shown in `SHA256:` format, demonstrating what `jpg fingerprint` output looks like. SHA-256 outputs are not secrets. |
+| 120  | `YWdl…CkF=`                  | Truncated illustrative age ciphertext armor header (`age-encryption.org/v1\n-> X25519 …`). No payload bytes. |
+| 141  | `dGVz…bmc=`                  | Base64-decodes to `test-public-key-bytes-32-chars-long`. Illustrative Ed25519 verifying key in a JPGP signature blob example. |
+| 142  | `bWFk…eXk=`                  | Base64-decodes to `made-up-signature-64-bytes-long-for-illustration-onlyyyyyyyyyy`. Obviously-fake signature bytes. |
+
+### Why the default `*.md` exclude didn't catch this
+
+gitsafe's `default-config` exclude list contains `*.md`. The
+`glob-match?` implementation treats `*` as "any non-`/` chars", so
+`*.md` matches `README.md` but not `docs/FORMATS.md`. A `**/*.md`
+glob would cover both — that's a candidate change for the default
+exclude list, but for now individual repos override locally.
+
+### Resolution
+
+Added `jerboa-pgp/.gitsafe.json`:
+
+```json
+{
+  "exclude": ["**/*.md", "docs/**"]
+}
+```
+
+This is per-repo because not all repos want Markdown excluded — a
+repo that stores real config snippets in Markdown might legitimately
+want them scanned.