Documentation

Policy & configuration

Start with Scanner's built-in defaults, then make governance explicit in source control with a policy file and optional local scanner configuration.

Policy-as-code

Scanner auto-discovers cerbi-policy.yml, cerbi-policy.yaml, or cerbi.logging.yml in the scan root. You can also pass an explicit file with --policy.

failThreshold: error # warning | error | blocker | none

disabledRules:
  # - CERBI006

severityOverrides:
  CERBI004: warning

allowedStructuredFields:
  - CorrelationId
  - EventId
  - TenantId
  - UserId

disallowedStructuredFields:
  - Password
  - AccessToken
  - Authorization

sensitiveDataPatterns:
  - Email
  - PhoneNumber
  - SocialSecurityNumber

Current policy surface

Supported settings are disabledRules, severityOverrides, failThreshold, allowedStructuredFields, disallowedStructuredFields, and sensitiveDataPatterns.

Generate a starter policy

Scanner can generate a YAML policy file that you can review and commit alongside the application:

cerbi-scanner scan ./src --generate-policy --output cerbi-policy.yml

After reviewing the generated file, use it explicitly with --policy cerbi-policy.yml or leave it at a recognized filename in the scan root for discovery.

Scanner configuration

Use cerbi-scanner.json for scanner behavior that should not be embedded in CI scripts. Pass another path with --config when needed.

{
  "defaultExcludes": ["**/obj/**", "**/bin/**", "**/node_modules/**", "**/*.g.cs"],
  "maxFileSizeKb": 512,
  "scanTimeoutSeconds": 120,
  "failThreshold": "high",
  "severityOverrides": {
    "CERBI004": "medium"
  },
  "suppressions": [
    {
      "ruleId": "CERBI001",
      "filePath": "tests/Fixtures",
      "fieldName": "password",
      "reason": "Intentional test fixture",
      "expiresOn": "2026-12-31"
    }
  ]
}

Suppressions

A suppression requires a rule ID. Optional file-path and field-name values narrow the match. When several values are provided, all non-empty values must match the finding.

Field	Behavior
ruleId	Required, case-insensitive exact match.
filePath	Optional substring match against the normalized finding path.
fieldName	Optional case-insensitive exact field-name match.
reason	Human-readable justification for the exception.
expiresOn	Optional ISO date. Expired suppressions are ignored and emit a warning.

Suppressed findings do not trigger the configured CI failure threshold. Use expiration dates for exceptions that should be reviewed instead of living forever.

Rules and CI behavior

Policy severity and fail thresholds are evaluated before the CLI exit decision. See Scanner rules for the current stable IDs and CI/CD for report-only and gate examples.