Ignore Rules

Ignore rules let you suppress specific findings from SCA scan results. Use them to filter out accepted risks, false positives, or findings that do not apply to your environment.

Rule Types

Type	Matches On	Example Value
CVE ID	Exact CVE identifier	`CVE-2021-23337`
Package Name	Dependency name (exact match)	`minimist`
File Path	Manifest location (glob supported)	`test/*/`
License	SPDX license identifier	`MIT`
Severity	Severity level and below	`low`

Creating an Ignore Rule

Go to SCA > Ignore Rules for the repository.
Click Add Rule.
Select the rule type from the dropdown.
Enter the match value.
Optionally set an expiration date. After this date the rule is automatically deactivated and suppressed findings reappear.
Add a justification note explaining why the finding is suppressed.
Click Save.

You can also create rules inline from any finding row by clicking the overflow menu and selecting Ignore.

How Suppression Works

When a scan completes, the results page shows two counts:

Effective findings — vulnerabilities that are currently actionable.
Suppressed findings — vulnerabilities matched by at least one active ignore rule.

Suppressed findings are hidden from the default view. Toggle Show suppressed to review them. Each suppressed finding displays the rule that matched it.

Ignore Rules vs Triage

Both features reduce noise, but they serve different purposes:

Aspect	Ignore Rules	Triage
Purpose	Permanent or time-boxed suppression	Workflow state tracking
Visibility	Hidden from default results	Visible with a status label
Scope	Applies to all future scans	Applies to a single finding instance
Typical use	Known false positives, accepted risks	In-progress investigation, deferred

Use ignore rules when a finding will never be relevant. Use triage when you need to track progress toward remediation.

Best Practices

Always include a justification so auditors understand why a finding was suppressed.
Prefer expiration dates over indefinite rules. Re-evaluate suppressed findings quarterly.
Use file path rules to exclude test and example directories rather than suppressing individual CVEs within them.
Review the suppressed findings count regularly. A high ratio of suppressed to effective findings may indicate overly broad rules.
Export your ignore rules before compliance audits so reviewers can verify each suppression.

API Reference


POST   /api/sca/ignore-rules          # Create a rule
GET    /api/sca/ignore-rules           # List all rules for a repo
DELETE /api/sca/ignore-rules/{rule_id} # Delete a rule