Skip to main content
The scanning configuration sets the rules Infisical uses when it scans your data sources. Without a configuration, Infisical uses the scanner’s built-in rules, which cover the credential formats of hundreds of services. The configuration uses the same format as the configuration file for local scans.
For repository scans, Infisical doesn’t use the files that local scans read, such as .infisical-scan.toml, .infisicalignore, or a baseline report, even if they’re in your repository.Enter your rules and allowlists in the scanning configuration instead.

​
Edit the scanning configuration

1
Go to Secret Scanning > Settings > Scanning Settings.
2
Enter your configuration in the text box, up to 5,000 characters.
3
Select Save.
Infisical uses the new configuration from the next scan onward. To apply it to commits that were already scanned, trigger a historical scan. config

​
Configuration format

A configuration replaces the scanner’s built-in rules unless it extends them.

​
Keep the built-in rules

To keep the built-in rules and add yours to them, set useDefault = true in the [extend] table:
​
boolean
Whether to keep the built-in rules. The built-in rules and their IDs are in the CLI’s default configuration.
​
string[]
The IDs of built-in rules to turn off.
Infisical can only read the configuration you enter, so don’t use path in the [extend] table to extend another configuration file.

​
Add a rule

Add a [[rules]] table for each kind of secret you want to detect:
If a rule has the same id as a built-in rule, the fields you set replace the built-in rule’s fields.
​
string
required
A unique ID for the rule.
​
string
What the rule detects.
​
string
A Go regular expression that matches the secret. A rule needs regex, path, or both.
​
string
A regular expression for file paths. On its own, path makes the rule report every file whose path matches. With regex, the rule only checks files whose path matches.
​
string[]
Words that a line must contain before the scanner checks the line against regex.
​
number
The minimum randomness a match needs.
​
integer
The group in regex that holds the secret.
​
table[]
Matches of this rule to skip, as [[rules.allowlists]] tables.
These are the fields most rules need. The scanner also accepts advanced fields, such as the ones that detect secrets made of several parts.

​
Ignore one line

To ignore a secret on one line of code, add a betterleaks:allow comment at the end of the line:
example.js
The scanner also accepts gitleaks:allow, so existing gitleaks:allow comments keep working.

​
Allowlists

To ignore secrets in specific files or commits, or secrets that match a pattern, add an [[allowlists]] table to the configuration:
The scanner skips a match if any field in the table matches it.
​
string
What the allowlist is for.
​
string[]
Regular expressions for the paths of files to skip.
​
string[]
The IDs of commits to skip.
​
string[]
Regular expressions for secrets to skip.
​
string[]
Words that, if a secret contains one, make the scanner skip the secret.
​
string
default:"OR"
Set to AND to skip a match only if every field you set matches it.