---
url: /en/security/intro.md
description: >
  Overview of CNB code security scanning configuration, including core concepts,
  core capabilities, usage recommendations, and configuration file location.
---
CNB Code Security Scanning checks repositories for secrets and open-source component risks. No configuration is
required by default. To adjust the scan scope, use `.scanignore` or `.cnb/security/code_scan_config.yml`.

## Core concepts

| Concept | Description |
|---|---|
| `.scanignore` | Repository-wide ignore file. Uses gitignore-style path rules and applies to all scan capabilities by default. |
| `code_scan_config.yml` | Configures scan scope, include files, and finding-handling rules per capability. |
| Security capability | The currently public capabilities are `secrets` and `software-composition-analysis`. Undeclared capabilities use platform defaults. |

:::: tip Configuration relationship
`.scanignore` and `code_scan_config.yml` can be used together. If a capability configures `scan.ignoreFrom`, that
capability uses the specified file, while other capabilities continue to use root `.scanignore`.
::::

## Core capabilities

| Capability | Description |
|---|---|
| Set a common scan scope | Use root `.scanignore` to exclude paths. |
| Adjust scan scope per capability | Use `ignoreFrom` to specify an ignore file, or add rules through `paths`. |
| Disable a capability | Point the capability's `ignoreFrom` to a file whose content is `**` to skip scanning for that capability. |
| Split configuration | Use `include` to split configuration into multiple subfiles and maintain them by module. |
| Ignore findings with rules (Beta) | Ignore matching scan results by rule, based on conditions such as path and severity. |

## Usage recommendations

* `.scanignore`, files referenced by `ignoreFrom`, and `paths` use gitignore-style path rules.
* If you only need common ignore rules, configure `.scanignore` alone.
* A file specified by `ignoreFrom` is not merged with `.scanignore`; it must contain all rules required by that
  capability.
* If no configuration is provided, the platform uses built-in defaults.
* Before submitting changes, use the `validate` plugin to check include paths, field structures, and ignore files.

For usage, see
[Configuration file · Self-check with the validate plugin](./config-file.md#self-check-with-the-validate-plugin).

## File location

```text
<repo-root>/
├── .scanignore                         # optional, common ignore rules
└── .cnb/
    └── security/
        ├── code_scan_config.yml        # optional, per-capability configuration
        └── scanignore/
            └── secrets                 # optional, referenced by ignoreFrom
```

## Next steps

* [Quick start](./quickstart.md) — enable code security scanning
* [Configuration file](./config-file.md) — learn about ignore files, include, merge rules, and validation
* [Syntax reference](./syntax-reference.md) — see the complete field-level reference