From 2d87500e11b8a79a7c44739bf839c1af09fecd9f Mon Sep 17 00:00:00 2001
From: rmcentee <rmcentee@cribl.io>
Date: Wed, 19 Aug 2026 15:01:52 -0700
Subject: [PATCH 1/2] chore(security): scope scanner configs to production code

---
 .semgrepignore | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 .semgrepignore

diff --git a/.semgrepignore b/.semgrepignore
new file mode 100644
index 0000000..2b5d887
--- /dev/null
+++ b/.semgrepignore
@@ -0,0 +1,26 @@
+# Semgrep scan scope — production code only.
+# NOTE: this file OVERRIDES Semgrep's default ignore list; the built-in
+# defaults are carried forward below. Without this file (or without these
+# defaults), node_modules/, dist/, vendor/, build/, .git, etc. come back
+# into SAST scope and generate noise.
+# Docs: https://docs.semgrep.dev/ignoring-files-folders-code
+#
+# Managed by repo-configure skill (cribl-product-security). 2026-08-19.
+# --- Semgrep defaults (carry forward — do not remove) ---
+.git
+.svn
+.hg
+build/
+vendor/
+dist/
+*.min.js
+.env/
+.tox/
+node_modules/
+.npm/
+.yarn/
+.venv/
+__pycache__/
+
+# --- Repo-specific non-production paths ---
+test/

From 79eb1e5a3fec0bb72da73232975ed9afe8bd134c Mon Sep 17 00:00:00 2001
From: rmcentee <rmcentee@cribl.io>
Date: Wed, 19 Aug 2026 15:31:02 -0700
Subject: [PATCH 2/2] chore(security): add socket.yml for SCA scope

---
 socket.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 socket.yml

diff --git a/socket.yml b/socket.yml
new file mode 100644
index 0000000..6fbef40
--- /dev/null
+++ b/socket.yml
@@ -0,0 +1,13 @@
+version: 2
+
+# Socket SCA scope configuration.
+#
+# In-scope (NOT listed below):
+#   - Root package.json (Node.js)
+#   - src/ (production code)
+#
+# Out-of-scope: see projectIgnorePaths below.
+# Socket always ignores .git, node_modules, coverage, dist — not repeated here.
+
+projectIgnorePaths:
+  - "test/**"