Skip to main content
By default, infisical scan uses the scanner’s built-in rules, which cover the credential formats of hundreds of services. To add your own rules or skip paths, use a configuration file. The file uses the same format as the configuration for repository scans.

​
Use a configuration file

Create a file named .infisical-scan.toml in the directory you scan. To use a file with a different name or location, pass it with --config or set INFISICAL_SCAN_CONFIG.
If more than one of these is set, the CLI uses the first one in this order:
  1. The --config flag
  2. The INFISICAL_SCAN_CONFIG environment variable
  3. .infisical-scan.toml in the directory you scan

​
Configuration format

A configuration replaces the scanner’s built-in rules unless it extends them.

​
Keep the built-in rules

To keep the built-in rules and add yours to them, set useDefault = true in the [extend] table:
.infisical-scan.toml
​
boolean
Whether to keep the built-in rules. The built-in rules and their IDs are in the CLI’s default configuration.
​
string[]
The IDs of built-in rules to turn off.
​
string
Another configuration file to extend instead of the built-in rules, relative to the directory you run the CLI in. You can’t set both path and useDefault.

​
Add a rule

Add a [[rules]] table for each kind of secret you want to detect:
.infisical-scan.toml
If a rule has the same id as a built-in rule, the fields you set replace the built-in rule’s fields.
​
string
required
A unique ID for the rule.
​
string
What the rule detects.
​
string
A Go regular expression that matches the secret. A rule needs regex, path, or both.
​
string
A regular expression for file paths. On its own, path makes the rule report every file whose path matches. With regex, the rule only checks files whose path matches.
​
string[]
Words that a line must contain before the scanner checks the line against regex.
​
number
The minimum randomness a match needs.
​
integer
The group in regex that holds the secret.
​
table[]
Matches of this rule to skip, as [[rules.allowlists]] tables.
​
string[]
Labels that appear on each finding the rule reports, in the Tags field of a report.
These are the fields most rules need. The scanner also accepts advanced fields, such as the ones that detect secrets made of several parts.

​
Allowlists

To ignore secrets in specific files or commits, or secrets that match a pattern, add an [[allowlists]] table to the configuration file:
.infisical-scan.toml
The scanner skips a match if any field in the table matches it.
​
string
What the allowlist is for.
​
string[]
Regular expressions for the paths of files to skip.
​
string[]
The IDs of commits to skip.
​
string[]
Regular expressions for secrets to skip.
​
string[]
Words that, if a secret contains one, make the scanner skip the secret.
​
string
default:"OR"
Set to AND to skip a match only if every field you set matches it.
To ignore specific findings, or every finding that already exists in a repository, see Ignore findings.