Ignoring findings

Suppression is a security decision. Gate treats it like one.

The shape

gate.config.ts

export default defineConfig({
  ignore: [
    {
      rule: 'GATE007',
      reason: 'Internal MCP server, pinned in our own registry',
    },
    {
      rule: 'GATE009',
      path: 'tools/local-dev/**',
      reason: 'Developer sandbox, never runs in CI or production',
    },
    {
      server: 'analytics',
      rule: 'GATE017',
      reason: 'Authenticates via mTLS at the mesh, not visible in config',
      expires: '2027-01-31',
    },
  ],
})

Why a reason is required

Gate refuses to apply an ignore entry that has no reason. It warns instead:

warning: Ignore entry for GATE007 has no reason and was not applied.
         Set `requireIgnoreReason: false` if you really want unexplained
         suppressions.

Six months from now, the reason is the only thing that will tell anyone whether the suppression is still true. Without it, a suppression is indistinguishable from an oversight, and the safe response to an unexplained suppression is to leave it alone forever. Temporary exceptions become permanent that way.

You can turn the requirement off:

export default defineConfig({ requireIgnoreReason: false })

Matching

Name
rule
Type
GATE0NN
Description
Suppress a specific rule.
Name
path
Type
string
Description
Suppress findings located in a path. Prefix match, or a glob with * and **.
Name
server
Type
string
Description
Suppress findings about a specific server, by name.
Name
expires
Type
ISO date
Description
Advisory. Gate records it so a review can find stale suppressions.

Fields combine with AND. An entry with none of rule, path or server is ignored: a suppression that matches everything is never what anybody meant.

Seeing what is hidden

gate scan --show-suppressed

Suppressed by configuration:
  GATE007  .mcp.json - Internal MCP server, pinned in our own registry

Without the flag, Gate still tells you the count, so suppressions never become invisible:

1 finding(s) suppressed by configuration. Run with --show-suppressed to list them.

Baseline or ignore?

Both stop a finding failing your build. They mean different things:

	Baseline	Ignore
Says	"We know about this, and we will get to it"	"This is fine here, and here is why"
Scope	Every current finding	One rule, path or server
Expires	When you re-record it	When someone reviews the reason
Good for	Adopting Gate on an existing repository	A genuine, explained exception

Use a baseline for adoption. Use ignore for the handful of findings you have actually decided about.