Security scanner ignore files must not use broad “blanket” suppression that can hide future real issues.

Standard

• Avoid rules that ignore by coarse attributes (e.g., fix-state: unknown) for wide sets of findings.
• Prefer explicit, reviewable exceptions: list the specific vulnerability IDs you intend to ignore.
• Add a short, human explanation per ignored CVE stating why the finding is not applicable/acceptable for your product and images.

Example

ignore:
  # CVE-2008-4318 is ignored because it affects Python,
  # and Kong images do not ship Python at runtime.
  - vulnerability: CVE-2008-4318

  # CVE-XXXX-YYYY is ignored because ... (document the reason)
  - vulnerability: CVE-XXXX-YYYY

If you think you must ignore a “fix-state”

• Scope it tightly and still anchor it to specific CVEs, and ensure there’s an update plan when the scanner state changes.

Review checklist

• Does the ignore rule target specific vulnerability IDs?
• Is there a clear comment explaining the exception?
• Could this rule accidentally ignore a new, relevant vulnerability in the future?