> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure local scans

> Add your own detection rules to infisical scan and skip secrets you've decided are safe.

By default, `infisical scan` uses the scanner's built-in rules, which cover the credential formats of hundreds of services. To add your own rules or skip paths, use a configuration file. The file uses the same format as the [configuration for repository scans](https://infisical.com/docs/documentation/platform/secret-scanning/configuration.md).

## Use a configuration file

Create a file named `.infisical-scan.toml` in the directory you scan. To use a file with a different name or location, pass it with `--config` or set `INFISICAL_SCAN_CONFIG`.

> [!NOTE]
>
> If more than one of these is set, the CLI uses the first one in this order:
>
> 1. The `--config` flag
> 2. The `INFISICAL_SCAN_CONFIG` environment variable
> 3. `.infisical-scan.toml` in the directory you scan

## Configuration format

A configuration replaces the scanner's built-in rules unless it extends them.

### Keep the built-in rules

To keep the built-in rules and add yours to them, set `useDefault = true` in the `[extend]` table:

```toml .infisical-scan.toml theme={"dark"}
[extend]
useDefault = true
disabledRules = ["generic-api-key"]
```

**useDefault** `boolean`

Whether to keep the built-in rules. The built-in rules and their IDs are in [the CLI's default configuration](https://github.com/Infisical/cli/blob/main/detect/config/betterleaks.toml).

**disabledRules** `string[]`

The IDs of built-in rules to turn off.

**path** `string`

Another configuration file to extend instead of the built-in rules, relative to the directory you run the CLI in. You can't set both `path` and `useDefault`.

### Add a rule

Add a `[[rules]]` table for each kind of secret you want to detect:

```toml .infisical-scan.toml theme={"dark"}
[[rules]]
id = "internal-api-token"
description = "Internal API token"
regex = '''itk_[a-z0-9]{32}'''
keywords = ["itk_"]
```

If a rule has the same `id` as a built-in rule, the fields you set replace the built-in rule's fields.

**id** `string` *required*

A unique ID for the rule.

**description** `string`

What the rule detects.

**regex** `string`

A [Go regular expression](https://pkg.go.dev/regexp/syntax) that matches the secret. A rule needs `regex`, `path`, or both.

**path** `string`

A regular expression for file paths. On its own, `path` makes the rule report every file whose path matches. With `regex`, the rule only checks files whose path matches.

**keywords** `string[]`

Words that a line must contain before the scanner checks the line against `regex`.

**entropy** `number`

The minimum randomness a match needs.

**secretGroup** `integer`

The group in `regex` that holds the secret.

**allowlists** `table[]`

Matches of this rule to skip, as `[[rules.allowlists]]` tables.

**properties**

The scanner skips a match if any field in the table matches it.

**description** `string`

What the allowlist is for.

**paths** `string[]`

Regular expressions for the paths of files to skip.

**commits** `string[]`

The IDs of commits to skip.

**regexes** `string[]`

Regular expressions for secrets to skip.

**stopwords** `string[]`

Words that, if a secret contains one, make the scanner skip the secret.

**condition** `string` (default: OR)

Set to `AND` to skip a match only if every field you set matches it.

**tags** `string[]`

Labels that appear on each finding the rule reports, in the `Tags` field of a report.

These are the fields most rules need. The scanner also accepts advanced fields, such as the ones that detect secrets made of several parts.

## Allowlists

To ignore secrets in specific files or commits, or secrets that match a pattern, add an `[[allowlists]]` table to the configuration file:

```toml .infisical-scan.toml theme={"dark"}
[[allowlists]]
description = "Test fixtures and a rotated key"
paths = ['''(^|/)testdata/''']
commits = ["bea0ff6e05a4de73a5db625d4ae181a015b50855"]
stopwords = ["example"]
```

The scanner skips a match if any field in the table matches it.

**description** `string`

What the allowlist is for.

**paths** `string[]`

Regular expressions for the paths of files to skip.

**commits** `string[]`

The IDs of commits to skip.

**regexes** `string[]`

Regular expressions for secrets to skip.

**stopwords** `string[]`

Words that, if a secret contains one, make the scanner skip the secret.

**condition** `string` (default: OR)

Set to `AND` to skip a match only if every field you set matches it.

To ignore specific findings, or every finding that already exists in a repository, see [Ignore findings](https://infisical.com/docs/documentation/platform/secret-scanning/ignore-findings.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.