Ignoring Files & Secrets

Four ways to exclude files or suppress false positives:

1. .guardyignore File

For files not in .gitignore. Uses same syntax as .gitignore.

# .guardyignore
docs/examples/        # Documentation with example secrets
test/fixtures/        # Test data
.claude/              # Development notes

Note: Files in .gitignore are already ignored by Guardy.

2. Scanner Exclude

Same as .guardyignore but in config:

# .guardy.yaml
scanner:
  exclude:
    - "docs/examples/**"
    - "**/*.sample"

3. Comment Directives

Ignore specific lines in code:

// guardy:ignore
const key = "sk_test_1234";

// guardy:ignore-next
const token = "example_token";

Works with //, #, /*, <!-- comments.

4. Allowlists

Specific Strings

scanner:
  allowlist:
    strings:
      - "sk_test_4eC39HqLyjWDarjtT1zdp7dc"  # Stripe test key

Specific Files

scanner:
  allowlist:
    files:
      - "README.md"

Pattern-Based

scanner:
  allowlist:
    patterns:
      - regex: 'FAKE_[A-Z_]+'
        reason: "Test constants"

Priority Order

1. .guardyignore / scanner.exclude → File never scanned
2. Comment directives → Line ignored during scan
3. allowlist.files → File results discarded
4. allowlist.patterns → Pattern matches discarded
5. allowlist.strings → Exact matches discarded

When to Use What

• .guardyignore → Directories and file patterns not in .gitignore
• scanner.exclude → Same as .guardyignore, just in config
• Comment directives → Specific lines of code
• allowlist.strings → Known false positives (test keys, examples)
• allowlist.patterns → Systematic false positive patterns