No Blanket Vulnerability Ignores

Security scanner ignore files must not use broad “blanket” suppression that can hide future real issues. **Standard** - Avoid rules that ignore by coarse attributes (e.g., `fix-state: unknown`) for wide sets of findings.

copy reviewer prompt

Prompt

Reviewer Prompt
Deploy Agent

Security scanner ignore files must not use broad “blanket” suppression that can hide future real issues.

Standard

  • Avoid rules that ignore by coarse attributes (e.g., fix-state: unknown) for wide sets of findings.
  • Prefer explicit, reviewable exceptions: list the specific vulnerability IDs you intend to ignore.
  • Add a short, human explanation per ignored CVE stating why the finding is not applicable/acceptable for your product and images.

Example

ignore:
  # CVE-2008-4318 is ignored because it affects Python,
  # and Kong images do not ship Python at runtime.
  - vulnerability: CVE-2008-4318

  # CVE-XXXX-YYYY is ignored because ... (document the reason)
  - vulnerability: CVE-XXXX-YYYY

If you think you must ignore a “fix-state”

  • Scope it tightly and still anchor it to specific CVEs, and ensure there’s an update plan when the scanner state changes.

Review checklist

  • Does the ignore rule target specific vulnerability IDs?
  • Is there a clear comment explaining the exception?
  • Could this rule accidentally ignore a new, relevant vulnerability in the future?

Source discussions