Skip to main content

Overview

The .cybedefend file allows you to exclude specific files or directories from SAST vulnerability reports. It uses the same syntax as .gitignore, making it familiar and easy to use.

How It Works

Create a .cybedefend file in your project’s root directory to define exclusion patterns. Vulnerabilities found in matching files will be automatically filtered from scan results.

Usage

Creating a .cybedefend File

Create a file named .cybedefend in your project root:

Supported Patterns

The syntax is identical to .gitignore:

Common Use Cases

Ignore Test Code

Ignore Third-Party Code

Ignore Demo/Example Code

Ignore Configuration Templates

Best Practices

Use .cybedefend responsibly. Don’t ignore real vulnerabilities in production code.

Document Your Exclusions

Always add comments explaining why files are excluded:

Include in Code Reviews

  • Add .cybedefend to your repository
  • Review changes in pull requests
  • Regularly audit exclusion patterns

Monitor Impact

Check scan logs to see how many vulnerabilities are filtered:

Troubleshooting

Patterns Not Matching

  • Use **/ for recursive matching: **/bad/**
  • Ensure correct path separators (always /)
  • Check that .cybedefend is in the project root
  • Review scan logs for path details

File Not Found

  • Verify .cybedefend is included in your repository
  • Check file permissions
  • Ensure the file is at the project root level

Example Configuration

Here’s a comprehensive example:
The .cybedefend file is processed during scanning. Excluded vulnerabilities won’t appear in your reports or affect your project metrics.