Quick Start covers the most common adjustments to code security scanning with minimal configuration.

When to use: scanning works out of the box, so use this page only when you need to adjust it: excluding third-party code and build artifacts, giving one capability its own ignore rules, temporarily disabling a capability, or splitting the config file with include. For the full field reference, see the Syntax Reference.

Where Each Adjustment Goes

Configuration lives in .scanignore at the repository root and in .cnb/security/. Pick the entry point by what you want to change:

Goal	Entry point
Share one set of ignore rules across all capabilities	.scanignore at the repository root
Give one capability its own ignore rules	That capability's scan.ignoreFrom
Disable a scan capability	Write ** in the file set by that capability's ignoreFrom (see below)
Split a long configuration	include in .cnb/security/code_scan_config.yml

Configure common ignore rules

Add .scanignore to the repository root. Its gitignore-style path rules apply to all scan capabilities by default:

.scanignore

# Repository root path
/go.mod

# Third-party code
vendor/
node_modules/

# Test fixtures
**/testdata/**

# Build artifacts
dist/
build/

If you only need common ignore rules, you do not need to create code_scan_config.yml.

Configure scan scope per capability

When one capability needs different ignore rules, specify a file through scan.ignoreFrom:

.cnb/security/code_scan_config.yml

secrets:
  scan:
    ignoreFrom: .cnb/security/scanignore/secrets

.cnb/security/scanignore/secrets

fixtures/
**/testdata/**

Once secrets switches to the specified file, other capabilities continue to use the root .scanignore. The two ignore files are not merged: the specified file must exist and contain all rules required by that capability.

Disable a scan capability

Point the capability's ignoreFrom to a file whose content is **, and the capability skips all paths. Take disabling only secrets as an example:

.cnb/security/code_scan_config.yml

secrets:
  scan:
    ignoreFrom: .cnb/security/scanignore/disabled # points to a ** file, so secrets skips all paths

.cnb/security/scanignore/disabled

**

Split configuration

When the configuration becomes long, you can split it into separate subfiles. All include paths are resolved relative to the repository root:

.cnb/security/code_scan_config.yml

include:
  - .cnb/security/checks/secrets.yml
  - .cnb/security/checks/sca.yml

.cnb/security/checks/secrets.yml

secrets:
  scan:
    ignoreFrom: .cnb/security/scanignore/secrets

.cnb/security/checks/sca.yml

software-composition-analysis:
  scan:
    paths:
      # Re-include a path on top of the common rules from root .scanignore
      - "!third_party/our-fork/**"

Warning

include paths must be relative to the repository root. URLs and cross-repository references are not supported. Include files are parsed recursively, with at most 50 files parsed in a single run. For details, see Configuration file.

Next steps

• Configuration file — ignore files, include details, and merge rules
• Syntax reference — complete field reference

Previous pageIntroduction

Next pageConfiguration File