Socket.dev false positives: suppress them in .socket.yml with package, issue, reason, expiry

Per the Socket.dev case study: suppress false positives in .socket.yml with a reason and an expiry - never ignore silently.

Context: Problem: Socket flags legitimate packages - unstableOwnership on workbox- (Google packages churn ownership internally) and @biomejs/ (fast-moving legitimate project), obfuscatedFile on safer-buffer (ships minified tests). Suppress these in .socket.yml under an ignore list: each entry names the package, the issue type, a human reason, and an expires date so the ignore is revisited. Documenting the reason keeps future-you (and auditors) from wondering why an alert was silenced.

Matched source

Source: Source: https://github.com/miccy/dont-be-shy-hulud/blob/HEAD/packages/docs-content/reference/case-study-socket.md Original query: "Socket.dev false positives: suppress them in .socket.yml with package, issue, reason, expiry" Key terms: expiry, false, issue, package, positives, reason, socket, suppress, them

Source: Problem: Socket flags legitimate packages - unstableOwnership on workbox- (Google packages churn ownership internally) and @biomejs/ (fast-moving legitimate project), obfuscatedFile on safer-buffer (ships minified tests). Suppress these in .socket.yml under an ignore list: each entry names the package, the issue type, a human reason, and an expires date so the ignore is revisited. Documenting the reason keeps future-you (and auditors) from wondering why an alert was silenced.

Verified resolution: Per the Socket.dev case study: suppress false positives in .socket.yml with a reason and an expiry - never ignore silently.

Source URL: https://github.com/miccy/dont-be-shy-hulud/blob/HEAD/packages/docs-content/reference/case-study-socket.md