.trivyignore

# Trivy Ignore File
# Suppress specific CVEs that are verified false positives or accepted risks.
# Format: one CVE ID per line, with a comment explaining WHY and (if temporary)
# an expiration date, e.g.:
#   CVE-2024-12345  # False positive: affects Windows only, we deploy on Linux. Expires: 2026-09-01
#
# NOTE: the Trivy CI jobs are currently DISABLED (see .github/workflows/security.yml,
# "TRIVY JOBS DISABLED — March 2026"). This file is retained so accepted-risk ignores
# have a home the moment Trivy is re-enabled. Dependency (SCA) ignores otherwise live
# in .snyk / pip-audit --ignore-vuln / dependency-review allow-ghsas — keep those in sync.
#
# Before adding an entry: research the CVE (NVD/vendor advisory), confirm it's truly a
# false positive or accepted risk, and never ignore a CRITICAL without explicit sign-off.
#
# Docs: https://aquasecurity.github.io/trivy/latest/docs/configuration/filtering/

# ── Accepted ignores (add below) ────────────────────────────────────────────
# (none yet)