Antra
How it worksStar1Get Started
Star1
Antra
How it worksStar1Get Started
Star1
Documentation
  • Introduction
  • Installation
  • Quick start
  • Configuration basics
  • Monorepos
  • Trust boundaries
  • Findings and severity
  • Schema providers
  • Suppressions and baselines
  • antra init
  • antra scan
  • antra sync
  • antra doctor
  • antra baseline
  • antra trace
  • antra watch
  • antra fix
  • antra query
  • antra studio
  • Studio
  • Launching Studio
  • Reading the graph
  • Configuration reference
  • BG-001: Server-to-client leak
  • BG-002: Unvalidated input
  • BG-003: Opaque object pass
  • BG-004: Secret in markup
  • GitHub Actions
  • Introduction
  • Installation
  • Quick start
  • Configuration basics
  • Monorepos
  • Trust boundaries
  • Findings and severity
  • Schema providers
  • Suppressions and baselines
  • antra init
  • antra scan
  • antra sync
  • antra doctor
  • antra baseline
  • antra trace
  • antra watch
  • antra fix
  • antra query
  • antra studio
  • Studio
  • Launching Studio
  • Reading the graph
  • Configuration reference
  • BG-001: Server-to-client leak
  • BG-002: Unvalidated input
  • BG-003: Opaque object pass
  • BG-004: Secret in markup
  • GitHub Actions

Suppressions and baselines

Two ways to silence a finding, and how they differ.

There are two ways to stop a finding being reported, and they solve different problems. Reaching for the wrong one is how a backlog becomes invisible rather than solved.

Suppressing one finding

A suppression is a directive placed at the crossing, carrying a reason:

// antra-disable-next-line
return <AccountCard account={account} />;

This is a statement about this line: the analysis is right that a value crosses here, and a human has decided it is acceptable. The reason is the whole point of it, since it is what the next person reads when they wonder whether the decision still holds.

antra fix inserts these mechanically when you pass a rule and a reason:

antra fix --suppress BG-001 --reason "account is projected before this point"

Baselining a report

A baseline is a statement about a moment in your codebase. It records the current violations, and from then on a scan reports only what has appeared since.

antra baseline

This is the answer to adopting a linter on a repository with years of history: without it, the first report is unusable and the second never happens.

Which one to use

SuppressionBaseline
ScopeOne crossingEvery current violation
Written toYour source, next to the codeLocal state under .antra/
Records a reasonYes, required by antra fixNo
Reviewed in a diffYesNo
Survives a line moveVia the directive's placementVia finding fingerprints

Use a suppression when you have looked at a specific crossing and made a judgement you want a reviewer to see. Use a baseline when the volume is the problem and your intent is to work the list down.

The honest caveat

Neither one fixes anything. Both are ways of deciding when to look, and a baseline in particular makes a real backlog stop being reported, which is the trade you are making when you run it.

Previous
Schema providers
Next
antra init
On this page
  • Suppressing one finding
  • Baselining a report
  • Which one to use
  • The honest caveat