Skip to main content

Configuration

Configure Zelsis using .zelsisrc.json and ignore specific files or rules with .zelsisignore.

The .zelsisrc.json File

Place a .zelsisrc.json file in the root of your repository to configure global scan behavior.

{
  "projectName": "My SaaS App",
  "minScoreThreshold": 80,
  "failStrategy": "smart",
  "gates": {
    "security": true,
    "legalCompliance": true,
    "infraDatabase": true,
    "designVibePolish": false,
    "vibeCareHealth": true
  },
  "ignoreRules": ["SEC-123", "UI-A11Y-01"],
  "ignoredPaths": ["tests/", "scripts/**/*.js"]
}

The .zelsisignore File

Similar to .gitignore, you can use .zelsisignore to suppress specific rules or ignore entire files/directories. Each line can be a file path or a rule code/ID.

Supported Rule Prefixes

You can ignore entire categories of rules by using the defined prefixes. The following prefixes are supported:

Prefix PatternOffset(s)
/^SEC-?(\d+)$/i0
/^NEXT-SB-?(\d+)$/i28000
/^NODE-WEB-?(\d+)$/i28100
/^AI-APP-?(\d+)$/i28200
/^GHA-?(\d+)$/i28250
/^LLM-V2-?(\d+)$/i28300
/^PRIV-?(\d+)$/i28400
/^CLOUD-V2-?(\d+)$/i28500
/^A11Y-?(\d+)$/i28600
/^SAAS3-?(\d+)$/i28700
/^NEXTAI-?(\d+)$/i28750
/^GAP-?(\d+)$/i28800
/^JSF-?(\d+)$/i28900
/^PYF-?(\d+)$/i29000
/^BEF-?(\d+)$/i29100
/^CFG-?(\d+)$/i29200
/^AST-?(\d+)$/i29300
/^SAAS-?(\d+)$/i23000
/^JS-SEC-?(\d+)$/i24000
/^CORE-?(\d+)$/i24100
/^DEP-?(\d+)$/i26000
/^LLM-?(\d+)$/i4000, 0
/^CLICHE-?(\d+)$/i200
/^UI-INTERACT-?(\d+)$/i1200
/^SEC-SECRET-?(\d+)$/i5000
/^DB-PERF-?(\d+)$/i6000
/^CLOUD-?(\d+)$/i7000
/^(?:WEB-PERF|PERF)-?(\d+)$/i7100
/^API-?(\d+)$/i7200
/^(?:SUPPLY|SBOM)-?(\d+)$/i7300
/^LLM-SEC-?(\d+)$/i8000
/^ZERO-AUTH-?(\d+)$/i8100
/^PRIVACY-?(\d+)$/i8200
/^IAC-?(\d+)$/i8300
/^CHAOS-?(\d+)$/i8400
/^GQL-?(\d+)$/i8500
/^(?:NEXT15|NEXT)-?(\d+)$/i8600
/^WEB3-?(\d+)$/i8700
/^(?:PY-SEC|PY)-?(\d+)$/i8800
/^K8S-?(\d+)$/i8900
/^GO-?(\d+)$/i9000
/^TENANT-?(\d+)$/i9100
/^CLOUD-SEC-?(\d+)$/i9200
/^MOB-SEC-?(\d+)$/i9300
/^EVENT-?(\d+)$/i9400
/^CICD-SEC-?(\d+)$/i9500
/^RUST-?(\d+)$/i9600
/^FINTECH-?(\d+)$/i9700
/^HIPAA-?(\d+)$/i9800
/^OTEL-?(\d+)$/i9900
/^(?:CPP-SEC|CPP)-?(\d+)$/i10000
/^ECOMM-?(\d+)$/i10100
/^GRPC-?(\d+)$/i10200
/^PG-?(\d+)$/i10300
/^WAF-?(\d+)$/i10400
/^WS-?(\d+)$/i10500
/^SOC2-?(\d+)$/i10600
/^CACHE-?(\d+)$/i10700
/^ISO-?(\d+)$/i10800
/^OAUTH-?(\d+)$/i10900
/^TF-?(\d+)$/i11000
/^CDN-?(\d+)$/i11100
/^MESH-?(\d+)$/i11200
/^SLS-?(\d+)$/i11300
/^GW-?(\d+)$/i11400
/^DATA-?(\d+)$/i11500
/^AIACT-?(\d+)$/i11600
/^CRON-?(\d+)$/i11700
/^DNS-?(\d+)$/i11800
/^NIST-?(\d+)$/i11900
/^GRPH-?(\d+)$/i12000
/^AUDIT-?(\d+)$/i12100
/^CONTAINER-?(\d+)$/i12200
/^TLS-?(\d+)$/i12300
/^DORA-?(\d+)$/i12400
/^MQ-?(\d+)$/i12500
/^SBOM-?(\d+)$/i12600
/^WASM-?(\d+)$/i12700
/^SSO-?(\d+)$/i12800
/^PCI4-?(\d+)$/i12900
/^SEARCH-?(\d+)$/i13000
/^SDP-?(\d+)$/i13100
/^OPA-?(\d+)$/i13200
/^CRYPTO-?(\d+)$/i13300
/^SOX-?(\d+)$/i13400
/^VECTOR-?(\d+)$/i13500
/^THREAT-?(\d+)$/i13600
/^FED-?(\d+)$/i13700
/^ASVS-?(\d+)$/i13800
/^FEDRAMP-?(\d+)$/i13900
/^TSDB-?(\d+)$/i14000
/^SLSA-?(\d+)$/i14100
/^EBPF-?(\d+)$/i14200
/^APIDEF-?(\d+)$/i14300
/^HIPAASEC-?(\d+)$/i14400
/^MQOPT-?(\d+)$/i14500
/^RASP-?(\d+)$/i14600
/^GRPCSEC-?(\d+)$/i14700
/^CSPM-?(\d+)$/i14800
/^GLBA-?(\d+)$/i14900
/^GEODIST-?(\d+)$/i15000
/^DECEPTION-?(\d+)$/i15100
/^WASM-EDGE-?(\d+)$/i15200
/^PQC-?(\d+)$/i15300
/^NIS2-?(\d+)$/i15400
/^SHARD-?(\d+)$/i15500
/^CTI-?(\d+)$/i15600
/^KERN-SEC-?(\d+)$/i15700
/^ISO20022-?(\d+)$/i15800
/^TSDB-OPT-?(\d+)$/i15900
/^AI-RED-?(\d+)$/i16000
/^FABRIC-?(\d+)$/i16100
/^QUANT-RISK-?(\d+)$/i16200
/^LLM-ORCH-?(\d+)$/i16300
/^CONF-COMPUTE-?(\d+)$/i16400
/^FED-LEARN-?(\d+)$/i16500
/^VEC-OPT-?(\d+)$/i16600
/^QKD-?(\d+)$/i16700
/^SPACE-MESH-?(\d+)$/i16800
/^AI-ETHICS-?(\d+)$/i16900
/^FHE-SEC-?(\d+)$/i17000
/^NEURO-COMP-?(\d+)$/i17100
/^AV-SAFETY-?(\d+)$/i17200
/^EDGE-AI-OPT-?(\d+)$/i17300
/^QRNG-?(\d+)$/i17400
/^MED-DEV-?(\d+)$/i17500
/^VEC-CACHE-?(\d+)$/i17600
/^DNA-STORE-?(\d+)$/i17700
/^SUBSEA-OPT-?(\d+)$/i17800
/^ZK-ROLLUP-?(\d+)$/i17900
/^DO178C-?(\d+)$/i18000
/^OPT-SWITCH-?(\d+)$/i18100
/^BCI-SEC-?(\d+)$/i18200
/^SCADA-SEC-?(\d+)$/i18300
/^SPACE-GNC-?(\d+)$/i18400
/^EUV-LITHO-?(\d+)$/i18500
/^IAEA-SAFE-?(\d+)$/i18600
/^HYPERS-FLT-?(\d+)$/i18700
/^MARITIME-COL-?(\d+)$/i18800
/^HFT-SEC-?(\d+)$/i18900
/^PATHOGEN-BIO-?(\d+)$/i19000
/^GEOTHERM-ENG-?(\d+)$/i19100
/^LAUNCH-FAA-?(\d+)$/i19200
/^CPO-OPTICS-?(\d+)$/i19300
/^MEV-DEFENSE-?(\d+)$/i19400
/^BIOREACT-ENG-?(\d+)$/i19500
/^HAPS-STRAT-?(\d+)$/i19600
/^DAC-CARBON-?(\d+)$/i19700
/^RAIL-PTC-?(\d+)$/i19800
/^SYNCHRO-PMU-?(\d+)$/i19900
/^ALE-PLASMA-?(\d+)$/i20000
/^DID-CRED-?(\d+)$/i20100
/^SUB-REACTOR-?(\d+)$/i20200
/^LIDAR-SPACE-?(\d+)$/i20300
/^FLOW-TOXIC-?(\d+)$/i20400
/^SSB-ANODE-?(\d+)$/i20500
/^SUBSEA-ACOU-?(\d+)$/i20600
/^NEUTRON-NDT-?(\d+)$/i20700
/^HYPER-SPECT-?(\d+)$/i20800
/^HVDC-GRID-?(\d+)$/i20900
/^CRYO-HYDRO-?(\d+)$/i21000
/^ZKML-PROOF-?(\d+)$/i21100
/^TOKAMAK-PLASMA-?(\d+)$/i21200
/^SAT-SWARM-?(\d+)$/i21300
/^PHOTON-QC-?(\d+)$/i21400
/^DEEPSEA-ROV-?(\d+)$/i21500
/^SYNBIO-GENE-?(\d+)$/i21600
/^BCI-NEURAL-?(\d+)$/i21700
/^AERO-TRAJECT-?(\d+)$/i21800
/^DIVERTOR-EROSION-?(\d+)$/i21900
/^ORGAN-CHIP-?(\d+)$/i22000
/^QUANTUM-BELL-?(\d+)$/i22100
/^UI-?(\d+)$/i0, 1000