Ignore accepted findings

Prefer fixing findings. Use .p2p-security-ignore.yaml only after you have confirmed that a finding is accepted risk.

Ignored findings are removed from active PR comments, workflow summaries, active totals, blocking counts, and policy failures. They remain in the JSON artifacts under ignored.vulnerabilities or ignored.secrets so accepted risk can still be reviewed later.

For vulnerabilities and image secrets, copy the finding details from the PR comment or workflow summary when the needed ID is shown there. If the comment is truncated or unavailable, download the workflow artifact and use source-security-findings.json or image-security-findings.json. For source secrets, use source-security-findings.json for the redacted secret ID. Do not add raw secret values to .p2p-security-ignore.yaml.

Schema

Create .p2p-security-ignore.yaml in the repository root, or in a nested application directory when you want source ignores to apply only to that directory.

version: 1 # required
 
images: # optional: image finding ignores
  - name: api # required: standard P2P image name, not a registry reference or tag
    vulnerabilities: # optional
      - id: CVE-2024-24790 # required: vulnerability ID, usually the CVE
        reason: "Runtime path is not reachable." # required
        package: stdlib # optional: exact package name match
        expires: "2026-09-30" # optional: YYYY-MM-DD
    secrets: # optional
      - id: p2psec_def456 # required: redacted image secret ID
        reason: "Synthetic credential in test fixture." # required
        path: /app/test-fixtures/example.env # optional: exact path match
        expires: "2026-09-30" # optional: YYYY-MM-DD
 
source: # optional: source finding ignores
  vulnerabilities: # optional
    - id: CVE-2024-12345 # required: vulnerability ID, usually the CVE
      reason: "Dev-only dependency." # required
      package: example-package # optional: exact package name match
      paths: # optional: exact Trivy target path matches
        - package-lock.json
      expires: "2026-09-30" # optional: YYYY-MM-DD
  secrets: # optional
    - id: source-secret-redacted-id # required: redacted source secret ID
      reason: "Rotated historical credential retained until rewrite decision." # required
      path: config/example.env # optional: exact source path match
      expires: "2026-09-30" # optional: YYYY-MM-DD

Scope and matching

package, paths, and path narrow an ignore entry. They are optional and use exact matching. Globs and regular expressions are not supported. Stage-specific ignores are not supported.

When expires is present, it must use YYYY-MM-DD. Expired entries no longer apply.

For source paths and path, values in the repository-root ignore file are repository-relative. Values in nested ignore files are relative to that ignore file’s directory.

Source scans discover every .p2p-security-ignore.yaml in the repository. A nested file’s source entries apply only to source findings under that directory. The repository-root file applies to the whole repository.

Image scans read only the repository-root ignore file and the ignore file in the selected application directory.