Configuration

ShipSafe works with zero configuration. When you need to customize behavior, these are your options.

.shipsafeignore

Create a .shipsafeignore file in your project root to exclude files and directories from scanning. The syntax is identical to .gitignore.

# .shipsafeignore

# Ignore test fixtures with intentionally vulnerable code
tests/fixtures/
__tests__/vulnerable-samples/

# Ignore generated files
dist/
build/
.next/

# Ignore specific files
scripts/seed-data.ts
migrations/*.sql

# Ignore vendor code
vendor/
third-party/

ShipSafe automatically respects your .gitignore in addition to .shipsafeignore. The node_modules directory is always excluded.

shipsafe.config.json

For advanced configuration, create a shipsafe.config.json file in your project root.

{
  "severity": "medium",
  "rules": {
    "disable": ["auth/missing-csrf-protection"],
    "override": {
      "secrets/generic-high-entropy": "low"
    }
  },
  "hooks": {
    "blockOn": "critical",
    "warnOn": "high",
    "scanStaged": true
  },
  "output": {
    "format": "text",
    "colors": true,
    "showFix": true
  },
  "scan": {
    "extensions": [".ts", ".tsx", ".js", ".jsx", ".py"],
    "maxFileSize": "1mb",
    "workers": 4
  }
}

Configuration Options

severity

Minimum severity to report: "critical", "high", "medium", or "low". Default: "low".

rules.disable

Array of rule IDs to disable. Use when a rule generates false positives for your specific codebase.

rules.override

Override the severity of specific rules. Useful for downgrading rules that are not relevant to your risk profile.

hooks.blockOn

Minimum severity to block a commit. Default: "critical".

scan.workers

Number of parallel workers for scanning. Default: CPU count. Set lower on memory-constrained systems.

Environment Variables

ShipSafe reads these environment variables, which override config file settings:

VariableDescriptionDefault
SHIPSAFE_SEVERITYMinimum severity to reportlow
SHIPSAFE_FORMATOutput format: text, json, sariftext
SHIPSAFE_NO_COLORDisable colored outputfalse
SHIPSAFE_WORKERSNumber of parallel workersCPU count
SHIPSAFE_LICENSE_KEYPro/Team license key—

Baseline Management

Baselines let you adopt ShipSafe on existing projects without being overwhelmed by pre-existing findings. See the CLI reference for full command details.

# Create a baseline from current findings
shipsafe scan --baseline

# Scan showing only new findings since baseline
shipsafe scan --delta

# Reset the baseline
shipsafe baseline reset

# View baseline summary
shipsafe baseline show

The baseline file is stored at .shipsafe/baseline.json. Commit this file to your repository so your entire team shares the same baseline.

Hook Configuration

Git hooks are configured in the hooks section of shipsafe.config.json:

{
  "hooks": {
    "blockOn": "critical",
    "warnOn": "high",
    "scanStaged": true,
    "timeout": 30000
  }
}
  • •blockOn — severity that blocks the commit (default: "critical")
  • •warnOn — severity that shows warnings (default: "high")
  • •scanStaged — only scan staged files, not the full project (default: true)
  • •timeout — max hook duration in milliseconds (default: 30000)