Mutes & Suppression
Path: /admin/mutes · Sidebar: Administration
Mutes suppress known-irrelevant findings so the team works a clean, trustworthy queue - without deleting anything (muted findings stay auditable).
Mute vs risk-accept
| Mute | Risk acceptance | |
|---|---|---|
| Meaning | "This is noise / not applicable here." | "This is real, but we accept it (with an owner + expiry)." |
| Scope | A finding, a rule, or a pattern (path/param/CWE). | A specific finding. |
| Visibility | Hidden from the default queue; still in the system. | Shown as accepted, resurfaces on expiry. |
How it works
- Mute a single finding, or create a mute rule that auto-suppresses matching future findings (by signature, path, parameter, CWE or scanner).
- Mutes are audited - who muted what, when and why - so an auditor can review every suppression.
- The FP feedback loop learns from mutes: similar findings are down-ranked automatically, sharpening precision over time.
Mute precisely
Prefer a narrow mute (this finding / this path) over a broad rule (this whole CWE). Over-muting hides real issues - and every mute is on the record.