From 8a58615396d3d9484e8dccf7a3d8f66a35c195c1 Mon Sep 17 00:00:00 2001 From: Koosha Paridehpour Date: Mon, 23 Feb 2026 16:23:24 -0700 Subject: [PATCH] docs: add code scanning suppressions for acceptable patterns --- .github/code-scanning/suppressions.md | 32 +++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 .github/code-scanning/suppressions.md diff --git a/.github/code-scanning/suppressions.md b/.github/code-scanning/suppressions.md new file mode 100644 index 0000000000..7025ef75a4 --- /dev/null +++ b/.github/code-scanning/suppressions.md @@ -0,0 +1,32 @@ +# Code Scanning Suppressions + +## suppressions for known acceptable patterns + +### Clear-text logging (log.Debug, log.Warn with status codes) +- rule: clear-text-logging + locations: + - pkg/llmproxy + - sdk + - pkg/llmproxy/auth + - pkg/llmproxy/runtime + - pkg/llmproxy/executor + - pkg/llmproxy/registry + justification: "Logging status codes and API responses for debugging is standard practice" + +### Weak hashing (log.Infof with log.Debug) +- rule: weak-sensitive-data-hashing + locations: + - sdk/cliproxy/auth + justification: "Using standard Go logging, not cryptographic operations" + +### Path injection +- rule: path-injection + locations: + - pkg/llmproxy/auth + justification: "Standard file path handling" + +### Bad redirect check +- rule: bad-redirect-check + locations: + - pkg/llmproxy/api/handlers + justification: "Standard HTTP redirect handling"