Configuration Schema

Place a nixer.yml file in the root of your repository to customize which detectors run, what severity levels trigger failures, which paths to ignore, and per-finding suppressions.

Full example

version: 1

# Paths to scan (default: all tracked files)
paths:
  include:
    - src/
    - services/
  ignore:
    - node_modules/
    - dist/
    - '**/*.test.js'
    - '**/*.spec.ts'

# Severity gate: fail if any finding at or above this level
fail-on:
  severity: high         # low | medium | high | critical
  count: 1              # fail if >= N findings at threshold

# Enable/disable detector modules
detectors:
  prompt-injection: true
  tool-abuse: true
  rag-poisoning: true
  mcp: true
  secrets: true
  model-supply-chain: true
  cicd: true
  fraud: false          # disabled for this repo

# Per-finding suppression
suppress:
  - rule: nixer/cicd/unpinned-action
    path: .github/workflows/legacy.yml
    reason: 'Legacy workflow, migration tracked in JIRA-1234'
  - rule: nixer/secrets/hardcoded-api-key
    path: tests/fixtures/dummy-key.js
    reason: 'Test fixture — not a real key'

Schema reference

version

Required. Currently only 1 is supported.

paths.include

List of glob patterns or directory paths to scan. Defaults to all tracked files. Useful for monorepos where you only want to scan a specific service subdirectory.

paths.ignore

List of glob patterns to exclude from scanning. Standard gitignore syntax. Common patterns:

• node_modules/ — skip dependencies
• dist/, build/ — skip build artifacts
• '**/*.test.js' — skip test files from secret scanning
• vendor/ — skip vendored code

fail-on.severity

Minimum severity level to cause a CI failure. Options: low, medium, high (default), critical. Set to critical to only fail on the most severe findings.

fail-on.count

Number of findings at fail-on.severity required before failing CI. Default: 1. Set to a higher number for a more permissive gate (e.g., only fail if 3+ high findings).

detectors

Enable or disable individual scanner modules. All modules are enabled by default. Set to false to disable:

suppress

Per-finding suppression list. Each entry requires:

• rule — the rule ID (e.g., nixer/cicd/unpinned-action). See the Findings Reference for all rule IDs.
• path — file path where the suppression applies. Supports globs.
• reason — required justification. Logged for audit trail.

Inline suppression comments

You can also suppress individual findings inline in source code using a comment directive:

// nixer-ignore: nixer/secrets/hardcoded-api-key -- test fixture, not a real key
const TEST_KEY = 'sk-test-1234567890abcdef';