Configuration

Customize H2 Scanner behavior for your project.

Ignore File (.h2ignore)

Create a .h2ignore file in your repository root to exclude files or directories:

# Ignore test fixtures
tests/fixtures/

# Ignore example files
examples/

# Ignore specific files
config/test-secrets.json

# Ignore patterns
*.test.js
*_test.go

Default Ignores

The scanner automatically ignores:

.git/
node_modules/
__pycache__/
.venv/
venv/
vendor/
dist/
build/
*.min.js
*.min.css
*.bundle.js
*.map

Scan Types

Secrets Detection

Detects hardcoded secrets, API keys, and credentials:

• AWS keys
• GitHub tokens
• Private keys (RSA, SSH)
• Database connection strings
• Generic API keys and passwords

Dependency Scanning

Checks dependencies against the OSV database:

Supported lockfiles:

• package-lock.json, yarn.lock, pnpm-lock.yaml
• requirements.txt, Pipfile.lock, poetry.lock
• go.sum, go.mod
• Cargo.lock
• Gemfile.lock
• composer.lock

Container Security

Analyzes Dockerfiles for:

• Running as root
• Using latest tags
• Missing health checks
• Exposed sensitive ports
• Insecure package installations

SAST (Static Analysis)

Supported languages:

• Python - SQL injection, command injection, XSS, insecure deserialization
• JavaScript/TypeScript - XSS, prototype pollution, eval usage
• Go - SQL injection, command injection, insecure crypto

Infrastructure as Code

Supported formats:

• Terraform - Insecure defaults, missing encryption, overly permissive IAM
• Kubernetes - Privileged containers, missing security contexts
• CloudFormation - Similar to Terraform checks

Severity Levels

Level	Description
critical	Immediate exploitation risk
high	Serious security vulnerability
medium	Moderate risk, should fix
low	Minor issue, best practice
info	Informational finding