---
url: /en/security/quickstart.md
description: >
  Get started with CNB code security scanning, including common ignore rules,
  per-capability scan scope, disabling scan capabilities, and splitting
  configuration with include.
---
## Configure common ignore rules

Add `.scanignore` to the repository root. Its gitignore-style path rules apply to all scan capabilities by default:

```text title=".scanignore"
# Repository root path
/go.mod

# Third-party code
vendor/
node_modules/

# Test fixtures
**/testdata/**

# Build artifacts
dist/
build/
```

If you only need common ignore rules, you do not need to create `code_scan_config.yml`.

## Configure scan scope per capability

When one capability needs different ignore rules, specify a file through `scan.ignoreFrom`:

```yaml title=".cnb/security/code_scan_config.yml"
secrets:
  scan:
    ignoreFrom: .cnb/security/scanignore/secrets
```

```text title=".cnb/security/scanignore/secrets"
fixtures/
**/testdata/**
```

`secrets` uses the specified file, while other capabilities continue to use root `.scanignore`. The two ignore files
are not merged. The specified file must exist and contain all rules required by that capability.

### Disable a scan capability

Point the capability's `ignoreFrom` to a file whose content is `**`. For example, to disable only `secrets`:

```yaml title=".cnb/security/code_scan_config.yml"
secrets:
  scan:
    ignoreFrom: .cnb/security/scanignore/disabled # points to a ** file, so secrets skips all paths
```

```text title=".cnb/security/scanignore/disabled"
**
```

### Split configuration

When the configuration becomes long, you can split it into separate subfiles. All include paths are resolved
**relative to the repository root**:

```yaml title=".cnb/security/code_scan_config.yml"
include:
  - .cnb/security/checks/secrets.yml
  - .cnb/security/checks/sca.yml
```

```yaml title=".cnb/security/checks/secrets.yml"
secrets:
  scan:
    ignoreFrom: .cnb/security/scanignore/secrets
```

```yaml title=".cnb/security/checks/sca.yml"
software-composition-analysis:
  scan:
    paths:
      # Re-include a path on top of the common rules from root .scanignore
      - "!third_party/our-fork/**"
```

:::: warning
include paths must be relative to the repository root. URLs and cross-repository references are not supported.
Include files are parsed recursively, with at most 50 files parsed in a single run. For details, see
[Configuration file](./config-file.md).
::::

## Configuration result

| Scan capability | Effective ignore file |
|---|---|
| Capability with `ignoreFrom` | The file specified by `ignoreFrom` |
| Capability without `ignoreFrom` | Root `.scanignore`, if present |

## Next steps

* [Configuration file](./config-file.md) — ignore files, include details, and merge rules
* [Syntax reference](./syntax-reference.md) — complete field reference