.plugin-scanner.toml

# HOL scans the full repository, including adversarial fixtures that exercise
# credential redaction and dynamic-execution detection. It also treats a
# descriptor-verified exact-byte module load as command injection, and confuses
# length-framed stdin plus RegExp.exec with file exfiltration and code execution.
# Suppress only those exact reviewed files; the repository's mandatory security
# gate still scans every tracked and unignored artifact.
[scanner]
ignore_paths = [
  "skills/cypress-debugger/scripts/publish-mochawesome-report.py",
  "skills/playwright-test-generator/scripts/raw-aria-snapshot.cjs",
  "scripts/ci/test-codex-smoke-contract.py",
  "scripts/ci/test-debugger-contracts.py",
  "scripts/ci/test-debugger-holdout-v1.py",
  "scripts/ci/test-eval-isolation.py",
  "scripts/ci/test-eval-schema.py",
  "scripts/ci/test-generator-faultkill-runner.py",
  "scripts/ci/test-independent-review-v6.py",
  "scripts/ci/test-independent-review.py",
  "scripts/ci/test-local-eslint-path.sh",
  "scripts/ci/test-playwright-debugger-artifact-download.py",
  "scripts/ci/test-reviewer-scanner.py",
  "scripts/evals/files/holdout-v3/cy-write-credentials/cypress/e2e/profile.cy.ts",
]