> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure repository scans

> Add your own detection rules and skip secrets you've decided are safe.

The scanning configuration sets the rules Infisical uses when it scans your [data sources](https://infisical.com/docs/documentation/platform/secret-scanning/scan-repositories.md). Without a configuration, Infisical uses the scanner's built-in rules, which cover the credential formats of hundreds of services. The configuration uses the same format as the configuration file for [local scans](https://infisical.com/docs/documentation/platform/secret-scanning/local-configuration.md).

> [!NOTE]
>
> For repository scans, Infisical doesn't use the files that [local scans](https://infisical.com/docs/documentation/platform/secret-scanning/scan-locally.md) read, such as `.infisical-scan.toml`, `.infisicalignore`, or a [baseline report](https://infisical.com/docs/documentation/platform/secret-scanning/ignore-findings.md#ignore-existing-findings), even if they're in your repository.
>
> Enter your rules and allowlists in the [scanning configuration](#edit-the-scanning-configuration) instead.

## Edit the scanning configuration

**Step 1**

Go to **Secret Scanning** > **Settings** > **Scanning Settings**.

**Step 2**

Enter your configuration in the text box, up to 5,000 characters.

**Step 3**

Select **Save**.

Infisical uses the new configuration from the next scan onward. To apply it to commits that were already scanned, [trigger a historical scan](https://infisical.com/docs/documentation/platform/secret-scanning/scan-repositories.md#run-a-historical-scan).

![config](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/secret-scanning/secret-scanning-config.png)

## Configuration format

A configuration replaces the scanner's built-in rules unless it extends them.

### Keep the built-in rules

To keep the built-in rules and add yours to them, set `useDefault = true` in the `[extend]` table:

```toml theme={"dark"}
[extend]
useDefault = true
disabledRules = ["generic-api-key"]
```

**useDefault** `boolean`

Whether to keep the built-in rules. The built-in rules and their IDs are in [the CLI's default configuration](https://github.com/Infisical/cli/blob/main/detect/config/betterleaks.toml).

**disabledRules** `string[]`

The IDs of built-in rules to turn off.

Infisical can only read the configuration you enter, so don't use `path` in the `[extend]` table to extend another configuration file.

### Add a rule

Add a `[[rules]]` table for each kind of secret you want to detect:

```toml theme={"dark"}
[[rules]]
id = "internal-api-token"
description = "Internal API token"
regex = '''itk_[a-z0-9]{32}'''
keywords = ["itk_"]
```

If a rule has the same `id` as a built-in rule, the fields you set replace the built-in rule's fields.

**id** `string` *required*

A unique ID for the rule.

**description** `string`

What the rule detects.

**regex** `string`

A [Go regular expression](https://pkg.go.dev/regexp/syntax) that matches the secret. A rule needs `regex`, `path`, or both.

**path** `string`

A regular expression for file paths. On its own, `path` makes the rule report every file whose path matches. With `regex`, the rule only checks files whose path matches.

**keywords** `string[]`

Words that a line must contain before the scanner checks the line against `regex`.

**entropy** `number`

The minimum randomness a match needs.

**secretGroup** `integer`

The group in `regex` that holds the secret.

**allowlists** `table[]`

Matches of this rule to skip, as `[[rules.allowlists]]` tables.

**properties**

The scanner skips a match if any field in the table matches it.

**description** `string`

What the allowlist is for.

**paths** `string[]`

Regular expressions for the paths of files to skip.

**commits** `string[]`

The IDs of commits to skip.

**regexes** `string[]`

Regular expressions for secrets to skip.

**stopwords** `string[]`

Words that, if a secret contains one, make the scanner skip the secret.

**condition** `string` (default: OR)

Set to `AND` to skip a match only if every field you set matches it.

These are the fields most rules need. The scanner also accepts advanced fields, such as the ones that detect secrets made of several parts.

## Ignore one line

To ignore a secret on one line of code, add a `betterleaks:allow` comment at the end of the line:

```js example.js theme={"dark"}
const testKey = "8dyfuiRyq=vVc3RRr_edRk-fK__JItpZ"; // betterleaks:allow
```

The scanner also accepts `gitleaks:allow`, so existing `gitleaks:allow` comments keep working.

## Allowlists

To ignore secrets in specific files or commits, or secrets that match a pattern, add an `[[allowlists]]` table to the configuration:

```toml theme={"dark"}
[[allowlists]]
description = "Test fixtures and a rotated key"
paths = ['''(^|/)testdata/''']
commits = ["bea0ff6e05a4de73a5db625d4ae181a015b50855"]
stopwords = ["example"]
```

The scanner skips a match if any field in the table matches it.

**description** `string`

What the allowlist is for.

**paths** `string[]`

Regular expressions for the paths of files to skip.

**commits** `string[]`

The IDs of commits to skip.

**regexes** `string[]`

Regular expressions for secrets to skip.

**stopwords** `string[]`

Words that, if a secret contains one, make the scanner skip the secret.

**condition** `string` (default: OR)

Set to `AND` to skip a match only if every field you set matches it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.