Security scanner ignore files must not use broad “blanket” suppression that can hide future real issues. **Standard** - Avoid rules that ignore by coarse attributes (e.g., `fix-state: unknown`) for wide sets of findings. - Prefer explicit, reviewable exceptions: list the **specific vulnerability IDs** you intend to ignore. - Add a **short, human explanation per ignored CVE** stating why the finding is not applicable/acceptable for your product and images. **Example** ```yaml ignore: # CVE-2008-4318 is ignored because it affects Python, # and Kong images do not ship Python at runtime. - vulnerability: CVE-2008-4318 # CVE-XXXX-YYYY is ignored because ... (document the reason) - vulnerability: CVE-XXXX-YYYY ``` **If you think you must ignore a “fix-state”** - Scope it tightly and still anchor it to specific CVEs, and ensure there’s an update plan when the scanner state changes. **Review checklist** - Does the ignore rule target specific `vulnerability` IDs? - Is there a clear comment explaining the exception? - Could this rule accidentally ignore a new, relevant vulnerability in the future?