antra fix
Apply mechanical remediations: today, reasoned suppression comments.
Applies the fixes that are mechanical enough to automate.
Usage
antra fix [path]
path is the Next.js app root and defaults to ..
antra fix --suppress BG-001 --reason "sanitized by parseUser()" --file app/account
antra fix --suppress all --reason "accepted for now, see SEC-142" --dry-run
Flags
What it writes
Today the only mechanical remediation is a reasoned suppression comment: a
directive inserted directly above the crossing, carrying the reason you pass in
--reason.
That is a real trade, and the command is named for what it does rather than what you might hope it does. It does not rewrite your code to sanitize a value. Deciding that a value is safe requires knowing your intent, and a tool that guesses will silently remove findings you needed to see.
Always run with --dry-run first when pointing --suppress all at a tree you
have not fixed yet. A blanket suppression is how a backlog becomes invisible
rather than solved.
Run it narrow
--file takes a path fragment, not a glob:
antra fix --suppress BG-003 --reason "projected upstream" --file apps/dashboard
Related
- Suppressions and baselines: the difference between suppressing one finding and baselining a report.