Skip to main content
If a scan reports a value you’ve decided is safe to commit, such as a test credential, you can stop the scan from reporting it.

​
Configuration file

In your configuration file, you can add allowlists that skip secrets by file path, commit, regular expression, or word. You can also turn off built-in rules that report values you don’t consider secrets.

Configuration

Add allowlists and turn off built-in rules in .infisical-scan.toml.

​
Ignore one line

To ignore a secret on one line of code, add a betterleaks:allow comment at the end of the line:
example.js
The scanner also accepts gitleaks:allow, so existing gitleaks:allow comments keep working.

​
Ignore specific findings

Each finding has a fingerprint, which is in the Fingerprint field of a JSON report. To ignore findings, list their fingerprints in a .infisicalignore file, one per line. Put the file in the directory you scan, which is the --source directory or, by default, the current directory:
.infisicalignore
A fingerprint takes one of two forms:
  • <commit>:<file>:<rule>:<line>: Ignores the finding in that commit only (what a scan of Git history reports)
  • <file>:<rule>:<line>: Ignores the finding in every commit (what a scan with --no-git reports)

​
Ignore existing findings

If you start scanning a repository that already has a long history, you can record every current finding in a baseline and have later scans report only new ones. First, write a JSON report of the current findings:
Then pass that report to later scans with --baseline-path:
findings.json then contains only the findings that aren’t in baseline.json. If you scan uncommitted changes with infisical scan git-changes, the scan doesn’t use a baseline.