What's the Difference Between .brassignore and .gitignore?
.gitignore tells git which files to exclude from version control. .brassignore tells BrassCoders which files or finding types to suppress — a different job, a different syntax.
Different Files, Different Jobs
BrassCoders does not read .gitignore — it reads .brassignore, a separate file at the project root that controls which files and which finding types the scan suppresses.
.gitignore (https://git-scm.com/docs/gitignore) tells git which files to leave out of version control — node_modules/, .env, build artifacts. BrassCoders does not read it. They are independent.
.brassignore lives at your project root and controls two distinct things:
- Glob rules: file paths matching these patterns are excluded from scanning entirely (same syntax as .gitignore’s subset — directory rules, wildcards, anchored paths).
- Type rules: lines starting with
:suppress specific finding types across the whole project. For example,:hardcoded_passwordsilences that detector everywhere.
If you want BrassCoders to skip the same directories git ignores, you need to duplicate those rules in .brassignore. The two files do not automatically stay in sync.
When to Use .brassignore
BrassCoders’s .brassignore is the right tool when a scanner keeps flagging a path or finding type that you’ve verified is benign — vendored code, generated files, or a false positive that BrassCoders keeps surfacing.
The most common .brassignore use cases:
# Exclude vendored dependencies entirely
vendor/
# Exclude generated OpenAPI types
src/api/generated/
# Suppress a specific detector project-wide
:hardcoded_password
# Suppress a privacy rule
:brass2_privacy.us_ssn.brassignore does not currently support negation (!). Each line is either a glob rule or a type rule — nothing else.
For a deeper walkthrough of .brassignore patterns, including how to tune out CI fixture files and legacy directories, see the BrassCoders tuning guide at https://coppersun.dev/blog/tuning-brasscoders-brassignore/.
Install BrassCoders with pip install brasscoders and run brasscoders scan . from your project root. The OSS core is free and Apache 2.0 licensed. BrassCoders Paid adds semantic noise reduction for $12/dev/month.
Frequently Asked Questions
Does BrassCoders automatically read .gitignore?
No — BrassCoders does not read .gitignore. If you want BrassCoders to skip directories that git ignores, add those same patterns to .brassignore. The two files are independent.
What syntax does .brassignore use?
Glob rules use a subset of gitignore syntax: trailing / means "this directory and all descendants," leading / anchors to project root, and * / ? / [abc] shell globs work via fnmatch. Type rules use a : prefix followed by the rule ID (e.g., :hardcoded_password). No negation (!) is supported.
Where does .brassignore go?
At your project root — the same directory you pass to brasscoders scan. If you run brasscoders scan /path/to/project, BrassCoders looks for /path/to/project/.brassignore. The file is optional; if absent, no rules are applied.
How do I suppress a specific finding type without excluding the whole file?
Use a type rule in .brassignore: add a line starting with : followed by the rule ID. For example, :hardcoded_password suppresses that detector across the whole project. The rule ID is the detector ID shown in the finding's metadata, visible in detailed_analysis.yaml.