Docs

Scanner Configuration

Tune Code Radar scan profiles, report output, cache behavior, vulnerability data, exclusions, and policy thresholds.

Summary

Scanner Configuration

Tune Code Radar scan profiles, report output, cache behavior, vulnerability data, exclusions, and policy thresholds.

Install Radar All docs

Create config

Use `radar init` to create starter configuration and adjust it per project.

radar init
radar scan . --config .radar.toml

Exclude reviewed false positives

Use finding exclusions for reviewed false positives. They work in local scans, MCP tools, pre-commit hooks, and GitHub Actions because the scanner marks matching findings as suppressed before scorecards and gates are computed.

[[exclusions.findings]]
rule_id = "SEC-SQLI-001"
path = "src/generated/**"
reason = "Generated query builder reviewed manually"

[[exclusions.findings]]
fingerprint = "finding-fingerprint-from-json"
reason = "False positive confirmed in review"