Introduction gives an overview of the core concepts and capabilities of CNB code security scanning.

When to use: when you want to know what the platform scans for by default and where to change it — for example confirming that secrets and open-source component risks are covered, or deciding between .scanignore and .cnb/security/code_scan_config.yml for scope adjustments. Scanning works out of the box with no configuration.

Core concepts

Concept	Description
.scanignore	Repository-wide ignore file. Uses gitignore-style path rules and applies to all scan capabilities by default.
code_scan_config.yml	Configures scan scope, include files, and finding-handling rules per capability.
Security capability	The currently public capabilities are secrets and software-composition-analysis. Undeclared capabilities use platform defaults.

Configuration relationship

.scanignore and code_scan_config.yml can be used together. If a capability configures scan.ignoreFrom, that capability uses the specified file, while other capabilities continue to use root .scanignore.

Core capabilities

Capability	Description
Set a common scan scope	Use root .scanignore to exclude paths.
Adjust scan scope per capability	Use ignoreFrom to specify an ignore file, or add rules through paths.
Disable a capability	Point the capability's ignoreFrom to a file whose content is ** to skip scanning for that capability.
Split configuration	Use include to split configuration into multiple subfiles and maintain them by module.
Ignore findings with rules (Beta)	Ignore matching scan results by rule, based on conditions such as path and severity.

Usage recommendations

• .scanignore, files referenced by ignoreFrom, and paths use gitignore-style path rules.
• If you only need common ignore rules, configure .scanignore alone.
• A file specified by ignoreFrom is not merged with .scanignore; it must contain all rules required by that capability.
• If no configuration is provided, the platform uses built-in defaults.
• Before submitting changes, use the validate plugin to check include paths, field structures, and ignore files.

For usage, see Configuration file · Self-check with the validate plugin.

File location

<repo-root>/
├── .scanignore                         # optional, common ignore rules
└── .cnb/
    └── security/
        ├── code_scan_config.yml        # optional, per-capability configuration
        └── scanignore/
            └── secrets                 # optional, referenced by ignoreFrom

Next steps

• Quick start — enable code security scanning
• Configuration file — learn about ignore files, include, merge rules, and validation
• Syntax reference — see the complete field-level reference

Next pageQuick Start