This guide walks you through the following configuration:

1. Create .cnb/security/code_scan_config.yml.
2. Use .scanignore to exclude paths that do not need to be scanned.
3. Disable a scan capability as needed, or split configuration with include.

Step 1: Create the configuration file

Add .cnb/security/code_scan_config.yml to the repository and let multiple scan capabilities share one .scanignore:

.cnb/security/code_scan_config.yml

secrets:
  scan:
    ignoreFrom: .scanignore
software-composition-analysis:
  scan:
    ignoreFrom: .scanignore

Undeclared capabilities use platform defaults. If this file is not provided, the platform also uses the built-in default configuration and scanning continues as usual.

Step 2: Add an ignore file

Add .scanignore to the repository root and declare paths that do not need to be scanned, using gitignore syntax:

.scanignore

# Repository root path
/go.mod

# Third-party code
vendor/
node_modules/

# Test fixtures
**/testdata/**

# Build artifacts
dist/
build/

Once ignoreFrom is explicitly declared, the target file must exist. If the file does not exist, configuration loading fails.

Step 3: Adjust configuration as needed

Disable a scan capability

Point the corresponding capability's ignoreFrom to a file whose content is **, and that capability skips all paths. For example, to disable only secrets:

.cnb/security/code_scan_config.yml

secrets:
  scan:
    ignoreFrom: .scanignore-disabled # points to a ** file, so secrets skips all paths

.scanignore-disabled

**

Split configuration

When the configuration becomes long, you can split it into separate subfiles. All include paths are resolved relative to the repository root:

.cnb/security/code_scan_config.yml

include:
  - .cnb/security/checks/secrets.yml
  - .cnb/security/checks/sca.yml

.cnb/security/checks/secrets.yml

secrets:
  scan:
    ignoreFrom: .scanignore

.cnb/security/checks/sca.yml

software-composition-analysis:
  scan:
    ignoreFrom: .scanignore
    paths:
      # Even if .scanignore excludes vendor, this negation rule forces it back into scanning
      - "!third_party/our-fork/**"

Note

include paths must be relative to the repository root. URLs and cross-repository references are not supported. Include files are parsed recursively, with at most 50 files parsed in a single run. For details, see Configuration file.

Next steps

• Configuration file — include details and merge rules
• Syntax reference — complete field reference

Previous pageIntroduction

Next pageConfiguration File