False Positive Handling

[DanArlowski]

I Couldn't find any info on this in the docs, credscan fails on false positives (On SVG images to be precise)
Is there any way i can flag files as false positives, maybe a .scanignore or something like that?

[prabhu]

@DanArlowski For credscan there is a bundled config that is used. You can send a PR by including svg to the extension shown.

https://github.com/ShiftLeftSecurity/sast-scan/blob/master/tools_config/credscan-config.toml#L587

Or you can set the environment variable CREDSCAN_CONFIG pointing to the directory (relative to the docker image) containing your custom credscan config file.