Kjell Tore Guttormsen
d9787aefb5
.llm-security-ignore: MEM/SIG/UNI rules added only for by-design findings, one explaining line each — the vendored conformance corpus, the Cyrillic confusables in injection-patterns.mjs and the homoglyph test inputs, the changelog's quoted homoglyph, the grade-F posture fixture, and the miner names in the supply-chain blocklist. Not suppressed on purpose: MEM on CLAUDE.md (the file a poisoning would target) and AST/TRG (no by-design findings once the ast-scan fixtures left the disk). Header prefix list completed (14 scanners) and the "150" replaced by the measured count. Self-scan, fresh clone of HEAD (node scanners/scan-orchestrator.mjs): before: BLOCK 80/100, 77 findings (1C 9H 29M 2L 36I), 362 suppressed after: WARNING 61/100, 58 findings (0C 5H 15M 2L 36I), 381 suppressed without the ignore file: BLOCK 95/100, 439 findings (unchanged) On `.` (working tree incl. local-only files): BLOCK 80/100, 80 findings -> WARNING 64/100, 61 findings. README: - Self-scan: the measured numbers replace "0 findings (ALLOW)". - The demo commands materialize the tree to a temp dir (the form the demo README uses); no evil-project-health/ path left in README. - New "Antivirus false positives" section + TOC entry: what the repo contains, why a classifier can still flag it, restore from quarantine, Microsoft's submission form, Microsoft's own advice against exclusions, a sparse-checkout recipe. Every Defender claim checked against learn.microsoft.com; the recipe run live against Forgejo (partial clone supported; 285 of 677 files on disk). The meaning of "!ml" is not claimed — Microsoft documents "!" suffixes only as internal indicators. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
90 lines
3.2 KiB
Text
90 lines
3.2 KiB
Text
# .llm-security-ignore — Suppress expected findings when scanning this plugin
|
|
#
|
|
# Why 381 suppressed findings? A security plugin that documents attack patterns,
|
|
# ships a malicious demo fixture, and tests against deliberately evil code will
|
|
# trigger its own scanners. This is the "scanning the scanner" paradox:
|
|
#
|
|
# - examples/ contains an intentionally malicious plugin (the demo)
|
|
# - knowledge/ documents real attack regex patterns and example URLs
|
|
# - tests/ contain deliberate taint flows and suspicious URLs as test input
|
|
# - hooks/ and scanners/ contain high-entropy regex for secret detection
|
|
#
|
|
# Every suppression below is explained. Run without this file to see all of them.
|
|
# Measured 2026-09-22 (v8.1.0) on a fresh clone: 439 findings without this file,
|
|
# 58 with it (381 suppressed).
|
|
#
|
|
# Format: SCANNER:glob or just glob (applies to all scanners)
|
|
# Scanners: UNI, ENT, PRM, DEP, TNT, GIT, NET, MEM, SCR, WFL, TRG, SIG, AST, TFA
|
|
|
|
# Demo fixture: intentionally malicious (the whole point of the demo)
|
|
examples/**
|
|
|
|
# Test files contain deliberate malicious patterns as test input
|
|
TNT:tests/**
|
|
NET:tests/**
|
|
|
|
# Knowledge base documents attack patterns with example URLs and regex
|
|
ENT:knowledge/**
|
|
NET:knowledge/**
|
|
|
|
# Hook scripts contain high-entropy regex patterns and log strings
|
|
ENT:hooks/**
|
|
|
|
# Scanner code contains regex patterns that trigger entropy detection
|
|
ENT:scanners/**
|
|
|
|
# Injection patterns module contains injection keywords (by design)
|
|
TNT:scanners/lib/injection-patterns.mjs
|
|
|
|
# Command files contain long prompt strings
|
|
ENT:commands/**
|
|
|
|
# Permission findings: clean needs write tools (by design), deep-scan uses Bash
|
|
PRM:commands/**
|
|
PRM:agents/**
|
|
|
|
# Git findings: subtree split artifacts and commit message heuristics
|
|
GIT:**
|
|
|
|
# Network: README references to OWASP, Anthropic, research papers
|
|
NET:README.md
|
|
|
|
# Network: agent docs reference example domains for documentation
|
|
NET:agents/**
|
|
|
|
# Network: supply-chain hook legitimately contacts osv.dev and socket.dev
|
|
NET:hooks/**
|
|
|
|
# Orchestrator legitimately writes log file from argv path
|
|
TNT:scanners/scan-orchestrator.mjs
|
|
|
|
# Toxic flow: plugin commands/agents have Read+Bash access by design (it's a security scanner)
|
|
TFA:commands/**
|
|
TFA:agents/**
|
|
|
|
# Network: CLAUDE.md references public repo URL
|
|
NET:CLAUDE.md
|
|
|
|
# Baseline files: generated JSON with scan results (high entropy expected)
|
|
reports/baselines/**
|
|
|
|
# Unicode: the vendored commons conformance corpus carries homoglyph and zero-width inputs on purpose
|
|
UNI:scanners/commons/conformance/**
|
|
|
|
# Unicode: Cyrillic confusables are detection patterns here (the lexicon matches the homoglyph form)
|
|
UNI:scanners/lib/injection-patterns.mjs
|
|
|
|
# Unicode: homoglyph test inputs for the string-utils folding tests
|
|
UNI:tests/lib/string-utils-homoglyph.test.mjs
|
|
|
|
# Unicode: the changelog quotes the homoglyph form a fix detects
|
|
UNI:CHANGELOG.md
|
|
|
|
# Memory: the grade-F posture fixture is poisoned on purpose (that is what grade F tests)
|
|
MEM:tests/fixtures/posture-scan/grade-f-project/**
|
|
|
|
# Signature: the supply-chain blocklist names miner packages so the install hook can block them
|
|
SIG:scanners/lib/supply-chain-data.mjs
|
|
|
|
# Not suppressed on purpose: MEM findings on CLAUDE.md (it documents the hooks, but it is the
|
|
# file a poisoning would target), and AST/TRG, which have no by-design findings here.
|