Skip to main content
ShipSafe
Sign In

● Configuration

Tune it. Without the YAML cult.

Two files run the show: .shipsafe.yml picks the rules, .shipsafeignore silences the noise.

▸ .SHIPSAFE.YML

.shipsafe.yml

Drop a .shipsafe.yml at the project root to override defaults. Generate one with:

TERMINAL
npx @ship-safe/cli init

Full Example

TERMINAL·.shipsafe.yml
# .shipsafe.yml — drop this in your project root

# Rules to include (default: all)
# Available categories: secrets, injection, xss, auth, authz,
# crypto, config, pii, baas, llm, headers, deps
rules:
  include:
    - secrets
    - injection
    - xss
    - auth
    - authz
    - crypto
    - config
    - pii
    - baas
    - llm
    - headers
    - deps
  # exclude:
  #   - deps    # skip dependency checks

# Glob patterns to exclude from scanning
exclude:
  - "node_modules"
  - ".git"
  - "dist"
  - "build"
  - "*.min.js"
  - "*.test.*"
  - "*.spec.*"

# Minimum severity to report: critical, high, medium, low
severity: low

▸ RULE OVERRIDES

Config Options

rules.include

Rule categories to scan. Omit it and every category runs.

Categories: secrets, injection, xss, auth, authz, crypto, config, pii, baas, llm, headers, deps

rules.exclude

Categories to skip. Use it when you want everything except one noisy bucket.

exclude

Glob patterns to skip, layered on top of the defaults.

Default exclusions: node_modules, .git, .next, dist, build, coverage, *.min.js, *.map, lock files, test files

severity

Minimum severity to report: critical, high, medium, low (default). Anything below gets hidden.

▸ IGNORE PATTERNS

.shipsafeignore

Silence rules you've already triaged. Ignored findings don't fail CI and show up as "suppressed" in the dashboard.

TERMINAL·.shipsafeignore
# .shipsafeignore — suppress specific rules
# Format: rule-id # optional reason

# These findings won't block CI or show in reports
secrets/generic-api-key  # Test fixture, not a real key
xss/dangerously-set-html # Sanitized by DOMPurify
injection/eval-usage     # Required for plugin system

Managing rules via CLI

TERMINAL
# Suppress a rule
npx @ship-safe/cli ignore secrets/generic-api-key -r "Test API key"

# Re-enable a rule
npx @ship-safe/cli unignore secrets/generic-api-key

▸ FILE SYNTAX

Ignore File Format

SyntaxMeaning
secrets/aws-access-keySuppress this rule ID
rule-id # reasonSuppress with a documented reason
# commentComment line (ignored)
(empty line)Ignored

▸ SUPPORTED FILES

Supported File Types

ShipSafe scans these automatically. Files over 1MB get skipped.

JavaScript

.js, .jsx, .mjs, .cjs

TypeScript

.ts, .tsx

Python

.py

Ruby

.rb

Go

.go

Java

.java

PHP

.php

Rust

.rs

C#

.cs

Swift

.swift

Kotlin

.kt

Config

.env, .yml, .json

▸ TIPS

Tips

← PreviousGit History SecretsNext →Security Rules