Configuration

Configuration lives in sentrasec.yaml at the repository root. Generate a starting point with:

sentrasec init

File structure

version: 1

app: payments-api

scanners:
  - sast
  - secrets
  - sca
  - iac

exclude:
  - "**/node_modules/**"
  - "**/vendor/**"
  - "**/*_test.go"
  - "fixtures/**"

severity:
  threshold: high      # exit non-zero at or above this level

rules:
  disable:
    - SS-SAST-0042     # false positive on generated code
  severity:
    SS-SECRETS-0007: critical

Sections

app

Associates scans with an app in your workspace so findings accumulate history against the right unit. Optional when running unauthenticated.

scanners

Restricts which scanners run. Omit the section entirely to run everything applicable: usually the right choice.

exclude

Glob patterns for paths to skip. Vendored dependencies and generated code are the common cases.

Be careful excluding test directories wholesale: test fixtures are a frequent home for real committed credentials.

severity.threshold

The level at or above which sentrasec scan exits non-zero. Controls pipeline gating.

rules.disable

Rule identifiers to suppress. Always comment why: an undocumented suppression is indistinguishable from a mistake six months later.

rules.severity

Override severity for specific rules where your context differs from the default.

Environment variables

Variable	Purpose
SENTRASEC_TOKEN	Workspace authentication token
SENTRASEC_API_URL	Your deployment endpoint, for self-hosted installations
SENTRASEC_CONFIG	Path to an alternative config file

Environment variables take precedence over the config file, which is what makes per-environment overrides work in CI.

Per-directory configuration

A monorepo can carry a sentrasec.yaml per component. The nearest configuration file above a scanned path wins, so components can set their own thresholds and exclusions without a single root file trying to describe everything.