In certain scenarios, if the administrator wants to ignore specific secret types, secret values, or paths, they can do so by creating an ignore.yaml file. On creating the ignore.yaml file, the file should be placed into the root directory of the repository, within a .blubracket folder.

When a match of the ignore file is made, an alert will not be created (but an event will still be generated).

For example, below is a repository called Test1, which has a .blubracket folder and within the folder is the ignore.yaml file.

A sample .blubracket/ignore.yaml is provided below:

Ignore by file path
- paths:
    - "**/*_test.go"
    - cli/cmd/default-sensitive-words-config.yaml
    - cli/cmd/data/*

# Ignore by secret value
# Equivalent to 'secret_value == my_password OR secret_value == my_token'
- secret_values:
    - my_password
    - my_token

# Ignore by secret type
# Equivalent to 'secret_type == password_assignment OR secret_type == secret_assignment'
- secret_types: password_assignment

Content Credit from Blubracket Article.

Manage false positives allows you to define few parameters and assign values to them which can be used to signal false positive at the time of scanning for code secrets. When you define a parameter as a false positive, you can easily detect these

Adding a False Positive Pattern

PCC Security tool allows you to add a false positive parameter which allows the

To add a false positive pattern, perform the following steps:

1.Login into PCC.

2. Search for the required project. The Project dashboard appears. Click Security from the LFX Tools STATUS tab.

3.The Security page appears. From the Manage False Positive tab, click Proceed.

4.The Manage False Positive page appears with the list of defined false positive parameters. Click Add False Positive Pattern to add a new false positive parameter.

5.The Add False Positive Pattern dialog box appears. There are three parameters that are available for you to select and define. After defining the parameter, click Add to add the parameter as false positive. The three parameters are:

• Path - Define the path for which you want to flag

• Secret Type - You can select the required secret type from the drop-down list. Some of the secret types are password assignment, JWT toke, AWS key and many other secret types are available for your to select.

• Secret Value - You should use a regular expression in order to define a value for Secret Value.

A regular expression (regex or regexp) is a sequence of characters that specifies a search pattern. Usually such patterns are used by string-searching algorithms for "find" or "find and replace" operations on strings, or for input validation.

The below tables assists you on how to use different regular expressions:

Regular Expression Quantifiers

Regular Expression Groups

Regular Expression Character Classes

Regular Expression Assertions

Regular Expression Flags

Regular Expression Special Characters

Regular Expression Posix Classes