Repository settings
Exclude paths and rules from a repository's scans, choose when its scans reach your webhooks, and show a README badge.
The Settings tab of a repository decides what its scans keep, when they reach you, and whether the repository shows a badge. Owners and Admins change it; every member sees it.
Exclusions
Exclusions drop results you know do not matter, so they stop drowning the real ones: test fixtures full of deliberately vulnerable packages, or an advisory that does not apply to how you use a library.
Excluded results are dropped when the scan's report reaches code.mlab.sh, and never stored. Exclusions apply to new scans only: results already stored stay as they are. Each scan says how many results your exclusions skipped, with a link to the list.
Path exclusions
A pattern is matched against the whole path of the file, which starts with /.
| Pattern | Matches |
|---|---|
*/tests/* | Every file under a tests directory, at any depth, the root one included |
tests/* | The tests directory at the root only. A pattern that does not start with * or / is anchored at the root. |
vendor/ | Everything under the root vendor directory. A trailing / means everything under it. |
*.min.js | Every minified JavaScript file |
* matches anything, / included.
Rule exclusions
Drop one advisory or one rule everywhere in the repository: GHSA-xxxx-xxxx-xxxx,
CVE-2024-12345, aws-access-key. The whole rule id is matched, ignoring case, and *
matches anything (GHSA-*).
An exclusion hides a result from every future scan. To dismiss one finding, tag it as a false positive or an accepted risk instead: the tag follows that finding only. See Triage.
Alerts
Choose when a finished scan of this repository is sent to your organization's webhooks
(scan.code.completed, set up on mlab.sh in
Organization settings → Webhooks):
| Setting | The event goes out |
|---|---|
| Every scan (default) | For every finished scan |
| New findings at or above a severity | Only when the scan found something at or above the severity you pick that the previous scan did not have |
A finding already present in the previous scan is never new, wherever its line moved. A failed scan
(scan.code.failed) is always sent, whatever the setting.
README badge
Show in your README that a repository is scanned by mlab.sh.
The badge is off by default and turned on per repository. Once on, the tab gives you the Markdown to paste:
[](https://code.mlab.sh)| Option | The badge shows |
|---|---|
| Default | scanned by mlab.sh and the date of the latest finished scan |
| With the grade | mlab.sh security, an A to F grade and the date |
The grade comes from the critical and high findings of the latest finished scan:
| Grade | Latest scan found |
|---|---|
| A | No critical or high finding |
| B | 1 or 2 high, no critical |
| C | 3 high or more, no critical |
| D | 1 critical |
| F | 2 critical or more |
The badge never shows the findings themselves, only the date and, if you choose, the letter. It turns grey when the latest scan is more than 30 days old.
The badge reveals nothing until you turn it on. An unknown address, a badge turned off and a repository not scanned yet all get the same grey not available badge, so the address never tells which repositories mlab watches. Turning the badge off deletes its address: a README still pointing at it shows not available from then on.