Exclusion rules

Filepath exclusions

By scanning your entire git history, or simply due to your software development activity, you could have many incidents on your GitGuardian dashboard. Decreasing the number of incidents and focusing only on those that matter most is therefore key. This feature only applies to secrets incidents.

Description

In your workspace settings, under the Secrets detection section, you can configure the filepaths you want to exclude from secrets detection. You can link specific repositories to these excluded filepaths, ensuring that the exclusion only applies to those repositories.

When a secret is leaked on an excluded filepath:

• you will not receive any notification,
• no incident will be created in your dashboard.

Note that newly created filepath exclusions will also apply to existing secret incidents and these would therefore be removed from your secret incidents table.

You have the ability to test a filepath against your exclusion list to verify your configuration.

Filepath format

The filepath format is a subset of the glob-style pattern. It uses the “/” character to separate each element of the path (POSIX norm), and allows the special “*” character as a wildcard. Additionally, the “**” sequence can be used to recursively match any number of directories.

PATTERN	CORRESPONDING REGEX	MATCHES	NON-MATCHES
test.py	test\.py$	src/tests/test.py	src/test/file.py src/test.py/README
tests/*.py	tests/([^/]+)\.py$	src/tests/test.py src/tests/file.py	src/test.py src/test.txt
/tests/*.py	^tests/([^/]+)\.py$	tests/test.py	src/tests/test.py
/*/test.py	^([^/]+)/test\.py$	src/test.py	test.py src/tests/test.py
src/**/test.py	src/([^/]+/)*test\.py$	src/test.py src/dir1/dir2/dir3/test.py dir1/src/test.py	dir1/dir2/dir3/test.py
/src/**/test.py	^src/([^/]+/)*test\.py$	src/test.py src/dir1/dir2/dir3/test.py	dir1/src/test.py
**/templates/	templates/	templates/file.html src/templates/file.html	src/file.html

If you misuse the glob-style pattern, GitGuardian will automatically correct your input. For instance:

• src/**/**/**/tests/ will be corrected to src/**/test
• **/src/** will be corrected to src/

Secret pattern exclusion

Description

In your workspace settings, under the Secrets detection section, you can configure the secret pattern you want to exclude from secrets detection. You can link specific repositories to these excluded secret pattern, ensuring that the exclusion only applies to those repositories. The secret pattern you define must use the regular expression pattern.

When a secret pattern is triggered:

• you will not receive any notification,
• no incident will be created in your dashboard.

Note that newly created secret pattern exclusions will also apply to existing secret incidents and these would therefore be removed from your incidents table.

You have the ability to test a secret pattern coverage.