Suppressing findings

A suppressed finding is removed before any output: it is not in the terminal report, SARIF or the upload, and it does not count towards --fail-on. Each run notes how many were removed in the SARIF notifications (N finding(s) suppressed by nosec comments, ... by ignore rules, ... test-code finding(s) suppressed).

The passes run in this order on every run, cached or not:

Order	Mechanism	Lives in	Matches
1	nosec comment	The source file	The line(s) of the finding, or the whole file from line 1
2	Ignore rule	.vulnetix/memory.yaml, and the organisation when signed in	Rule ID, file path, category
3	--suppress-test-code	The flag	Every finding in a test file

nosec comments

Put nosec in a comment on a line the finding covers (from its start line to its end line):

data = pickle.loads(blob)            # nosec vnx-py-003
subprocess.call(cmd, shell=True)     # nosec vnx-py-007, vnx-1100
os.system(cmd)                       # nosec

h := md5.New() // nosec VNX-CRYPTO-001

Form	Effect
nosec on the finding’s line	Drops every finding on that line.
nosec <id>[,<id>...] on the finding’s line	Drops only those rule IDs. IDs are case-insensitive and may be separated by commas or spaces.
nosec on line 1 of a file	Drops every finding in the file.
nosec <id>... on line 1	Drops those rule IDs in the whole file.

The token is recognised after #, //, -- or ;, anywhere on the line, so it works in every language the engine reads, including SQL, Lua and INI files. The syntax is compatible with gosec’s.

Each nosec hit is recorded in .vulnetix/memory.yaml as a suppression with type: nosec, the file, the line and the snippet, and, signed in, sent to the organisation so the console shows it as suppressed rather than fixed.

Ignore rules

vulnetix ignore (alias vulnetix suppress) records a rule. Without credentials it lives in .vulnetix/memory.yaml and works offline; signed in, it is also stored for the organisation and applied to every repository it names.

# One rule, whole repository, for 30 days
vulnetix ignore add --rule vnx-1100 --type risk_accepted --reason "CLI only runs on Linux" --expires-in 30

# One rule in one file
vulnetix ignore add --rule vnx-py-003 --file app/cache.py --type false_positive --reason "Blob is signed and verified first"

# Every SAST finding in one generated file
vulnetix ignore add --file gen/api.pb.go --category sast --type wont_fix --reason "Generated by protoc"

vulnetix ignore list
vulnetix ignore remove --rule vnx-1100 --reason "Windows support added"
vulnetix ignore sync

ignore add flag	Effect on SAST findings
--rule	Rule ID, compared case-insensitively with the finding’s ruleId.
--file	Matches the finding’s path exactly, or a path that ends in /<value>. A directory does not match the files in it; use --exclude for a directory.
--category	sast for SAST findings (also secrets, iac, container, sca, license, malware, crypto, ai).
--type	false_positive, wont_fix, risk_accepted, mitigated, deferred, rego_rule, nosec. Default: rego_rule when --rule is given, else risk_accepted.
--reason	Stored with the rule.
--expires-in	Days until the rule stops applying; 0 never expires.
--line, --line-range	Recorded, but not used when matching SAST findings: the rule applies to the whole file.
--path	Repository the rule is scoped to (default .).

At least one of --rule, --finding, --file or --value is required. The full command is documented under /vulnerability-management/.

--disable-memory stops the scan reading .vulnetix/memory.yaml, so local ignore rules are not applied on that run. Organisation rules still are.

Test code

vulnetix sast --suppress-test-code

Every finding in a file recognised as test code (see Test code) is removed and recorded as a test-code suppression, uploaded with the snapshot when signed in. Without the flag, test-code findings are kept, tagged vulnetix/test-suite in SARIF and listed under IN TESTS.

Excluding instead of suppressing

To stop reading code at all, rather than hiding what was found in it, use --exclude:

vulnetix sast --exclude third_party/ --exclude '*.min.js' --exclude /gen/

--exclude takes .gitignore pattern syntax: a trailing / matches directories, a leading / (or ./) anchors to --path, and an unanchored pattern matches at any depth. Excluded files are never evaluated, cost nothing, and leave no record. Suppressions leave an auditable record of what was found and why it was accepted.