> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure local scans

> Add your own detection rules to infisical scan and skip secrets you've decided are safe.

By default, `infisical scan` uses the scanner's built-in rules, which cover the credential formats of hundreds of services. To add your own rules or skip paths, use a configuration file. The file uses the same format as the [configuration for repository scans](/docs/documentation/platform/secret-scanning/configuration).

## Use a configuration file

Create a file named `.infisical-scan.toml` in the directory you scan. To use a file with a different name or location, pass it with `--config` or set `INFISICAL_SCAN_CONFIG`.

<Info>
  If more than one of these is set, the CLI uses the first one in this order:

  1. The `--config` flag
  2. The `INFISICAL_SCAN_CONFIG` environment variable
  3. `.infisical-scan.toml` in the directory you scan
</Info>

## Configuration format

A configuration replaces the scanner's built-in rules unless it extends them.

### Keep the built-in rules

To keep the built-in rules and add yours to them, set `useDefault = true` in the `[extend]` table:

```toml .infisical-scan.toml theme={"dark"}
[extend]
useDefault = true
disabledRules = ["generic-api-key"]
```

<ResponseField name="useDefault" type="boolean">
  Whether to keep the built-in rules. The built-in rules and their IDs are in [the CLI's default configuration](https://github.com/Infisical/cli/blob/main/detect/config/betterleaks.toml).
</ResponseField>

<ResponseField name="disabledRules" type="string[]">
  The IDs of built-in rules to turn off.
</ResponseField>

<ResponseField name="path" type="string">
  Another configuration file to extend instead of the built-in rules, relative to the directory you run the CLI in. You can't set both `path` and `useDefault`.
</ResponseField>

### Add a rule

Add a `[[rules]]` table for each kind of secret you want to detect:

```toml .infisical-scan.toml theme={"dark"}
[[rules]]
id = "internal-api-token"
description = "Internal API token"
regex = '''itk_[a-z0-9]{32}'''
keywords = ["itk_"]
```

If a rule has the same `id` as a built-in rule, the fields you set replace the built-in rule's fields.

<ResponseField name="id" type="string" required>
  A unique ID for the rule.
</ResponseField>

<ResponseField name="description" type="string">
  What the rule detects.
</ResponseField>

<ResponseField name="regex" type="string">
  A [Go regular expression](https://pkg.go.dev/regexp/syntax) that matches the secret. A rule needs `regex`, `path`, or both.
</ResponseField>

<ResponseField name="path" type="string">
  A regular expression for file paths. On its own, `path` makes the rule report every file whose path matches. With `regex`, the rule only checks files whose path matches.
</ResponseField>

<ResponseField name="keywords" type="string[]">
  Words that a line must contain before the scanner checks the line against `regex`.
</ResponseField>

<ResponseField name="entropy" type="number">
  The minimum randomness a match needs.
</ResponseField>

<ResponseField name="secretGroup" type="integer">
  The group in `regex` that holds the secret.
</ResponseField>

<ResponseField name="allowlists" type="table[]">
  Matches of this rule to skip, as `[[rules.allowlists]]` tables.

  <Expandable title="properties">
    The scanner skips a match if any field in the table matches it.

    <ResponseField name="description" type="string">
      What the allowlist is for.
    </ResponseField>

    <ResponseField name="paths" type="string[]">
      Regular expressions for the paths of files to skip.
    </ResponseField>

    <ResponseField name="commits" type="string[]">
      The IDs of commits to skip.
    </ResponseField>

    <ResponseField name="regexes" type="string[]">
      Regular expressions for secrets to skip.
    </ResponseField>

    <ResponseField name="stopwords" type="string[]">
      Words that, if a secret contains one, make the scanner skip the secret.
    </ResponseField>

    <ResponseField name="condition" type="string" default="OR">
      Set to `AND` to skip a match only if every field you set matches it.
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="tags" type="string[]">
  Labels that appear on each finding the rule reports, in the `Tags` field of a report.
</ResponseField>

These are the fields most rules need. The scanner also accepts advanced fields, such as the ones that detect secrets made of several parts.

## Allowlists

To ignore secrets in specific files or commits, or secrets that match a pattern, add an `[[allowlists]]` table to the configuration file:

```toml .infisical-scan.toml theme={"dark"}
[[allowlists]]
description = "Test fixtures and a rotated key"
paths = ['''(^|/)testdata/''']
commits = ["bea0ff6e05a4de73a5db625d4ae181a015b50855"]
stopwords = ["example"]
```

The scanner skips a match if any field in the table matches it.

<ResponseField name="description" type="string">
  What the allowlist is for.
</ResponseField>

<ResponseField name="paths" type="string[]">
  Regular expressions for the paths of files to skip.
</ResponseField>

<ResponseField name="commits" type="string[]">
  The IDs of commits to skip.
</ResponseField>

<ResponseField name="regexes" type="string[]">
  Regular expressions for secrets to skip.
</ResponseField>

<ResponseField name="stopwords" type="string[]">
  Words that, if a secret contains one, make the scanner skip the secret.
</ResponseField>

<ResponseField name="condition" type="string" default="OR">
  Set to `AND` to skip a match only if every field you set matches it.
</ResponseField>

To ignore specific findings, or every finding that already exists in a repository, see [Ignore findings](/docs/documentation/platform/secret-scanning/ignore-findings).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.