Configuration

A .vygl.yml file at your repository root configures per-engine exclusions, the CI severity gate, and project binding. Settings the file doesn’t define fall back to project-level settings in the dashboard, then to defaults.

Full example

project_id: prj_abc123       # Optional — overrides VYGL_PROJECT_ID and auto-detection
scan:
  fail_on: high
  send_committer: true       # Default true — set false to omit author metadata

  engine_timeout_seconds: 2700   # per-engine budget; SAST default 2700, others 900
  allow_incomplete: false        # true = pass even if an engine runs out of time
  cache: true                    # false = re-analyse every file on every run

  sast:
    exclude_paths:
      - "static/lib/"
      - "*.min.js"
    exclude_rules:
      - "javascript.express.audit.express-cookie-session-no-secure"

  sca:
    exclude_packages:
      - "pkg:npm/lodash"

  iac:
    frameworks:
      - terraform
      - dockerfile
    exclude_checks:
      - CKV_AWS_46

Top-level keys

project_id

Optional. Binds the scan to a specific Vygl project ID. Equivalent to --project-id on the CLI or VYGL_PROJECT_ID in the env. CLI flag wins; otherwise the precedence is env → file → auto-detect from git remote.

scan.fail_on

The CI severity gate. Valid values: critical, high, medium, low. The CLI exits non-zero when findings at or above this level are present. See Severity Gates for the precedence rules.

scan.send_committer

Default true. When false, the CLI omits commit author email/name/external-id from the upload. Useful when CI runs as a service identity and you don’t want that account credited as the committer.

scan.engine_timeout_seconds

How long each engine may run, in seconds. Defaults: 2700 (45 minutes) for SAST, 3600 for cloud, 900 for the others; also VYGL_ENGINE_TIMEOUT_S. The engines run side by side, so the whole scan takes about as long as the slowest one. An engine that runs out of time is stopped, and the scan ends INCOMPLETE (exit 2) rather than passing.

scan.allow_incomplete

Default false. When true, a scan in which an engine ran out of time still passes (with a warning). Same as --allow-incomplete.

scan.cache

Default true. SAST keeps each file’s results between runs, keyed by the file’s contents, its path, the exact rules and the engine version, so the next scan only analyses files that changed — and is still a full scan. false (or --no-cache, or VYGL_NO_CACHE=1) re-analyses everything every time. See Large repositories for caching it in CI.

scan.sast.exclude_paths

Patterns for files SAST should skip, in gitignore glob syntax: * and ? within a path segment, ** across segments, a trailing / for directories only. Each pattern matches at any depth — static/lib/ skips addons/web/static/lib/ too, and a leading / does not anchor it. ! is an ordinary character, not negation.

SAST already skips tests/, test/, node_modules/, vendor/, build/, dist/, .venv/, *_test.go and *.min.js by default, along with anything in .gitignore — unless the repository has its own .semgrepignore, which replaces those defaults.

Findings in files you exclude are retired as Out of policy on the next full scan — they are not counted as fixed — and come back on their own if the path is scanned again.

scan.sast.exclude_rules

Rule-ID list passed to OpenGrep as --exclude-rule. Useful for rules that are noisy in your codebase but you don’t want to disable for the whole org.

scan.sca.exclude_packages

Skip findings for specific packages, written as PURLs (pkg:npm/lodash, pkg:pypi/requests). Useful when a vulnerable dependency has a documented mitigation in your environment.

scan.iac.frameworks

Restrict Checkov to a subset of terraform, dockerfile, kubernetes, cloudformation. Default is to scan everything Checkov can identify.

scan.iac.exclude_checks

Checkov check IDs to skip (e.g. CKV_AWS_46). Use this when a specific check is deliberately accepted across the whole repo.

Suppressing findings

For per-finding suppression, use:

• Inline novygl comments in source — the engine drops the finding at scan time. See Inline Suppression.
• Triage in the dashboard — mark findings false_positive, ignored, or suppressed. The decision is sticky across rescans.

There is no .vygl.yml fingerprint or path-based suppression for the Secrets engine today; rely on novygl comments or in-dashboard triage.

Environment variables

The CLI also reads these environment variables (CLI flags take precedence over both the env and the config file):

Variable	Purpose
VYGL_API_KEY	API key for authentication (required for cloud upload).
VYGL_API_URL	API base URL (default: https://api.vygl.io).
VYGL_PROJECT_ID	Override auto-detected project ID.
VYGL_GIT_PROVIDER	Force the SCM type (github, gitlab, bitbucket, gitea).
VYGL_ENGINE_TIMEOUT_S	Per-engine time budget in seconds (see scan.engine_timeout_seconds).
VYGL_CACHE_DIR	Where the SAST result cache lives (default ~/.cache/vygl).
VYGL_NO_CACHE	1 turns the SAST result cache off.

CI-native vars (GITHUB_*, CI_*, BITBUCKET_*, GITEA_*) are read for branch / commit / repo / PR / committer auto-detection — see CI/CD Pipelines.

Note

The loader accepts any of .vygl.yml, .vygl.yaml, vygl.yml, .vigil.yml, .vigil.yaml, or vigil.yml. The legacy vigil-prefixed names are loaded transparently — no need to rename existing configs.