Security scanner ignore files must not use broad “blanket” suppression that can hide future real issues.
Standard
- Avoid rules that ignore by coarse attributes (e.g.,
fix-state: unknown) for wide sets of findings.
- Prefer explicit, reviewable exceptions: list the specific vulnerability IDs you intend to ignore.
- Add a short, human explanation per ignored CVE stating why the finding is not applicable/acceptable for your product and images.
Example
ignore:
# CVE-2008-4318 is ignored because it affects Python,
# and Kong images do not ship Python at runtime.
- vulnerability: CVE-2008-4318
# CVE-XXXX-YYYY is ignored because ... (document the reason)
- vulnerability: CVE-XXXX-YYYY
If you think you must ignore a “fix-state”
- Scope it tightly and still anchor it to specific CVEs, and ensure there’s an update plan when the scanner state changes.
Review checklist
- Does the ignore rule target specific
vulnerability IDs?
- Is there a clear comment explaining the exception?
- Could this rule accidentally ignore a new, relevant vulnerability in the future?