Baselines and suppressions

Establish a baseline

Review the existing findings before recording them:

kaev check --verbose
kaev baseline
git add .kaev-baseline.json
git commit -m "chore: establish KAEV baseline"

Future checks show and gate findings that are not recorded in the baseline. Fingerprints contain finding identity, not source code.

Caution

A baseline does not declare existing findings safe and does not improve their scores. It creates an auditable migration path while the existing debt is resolved.

Suppress an intentional finding

Use .kaevrc.json when a specific rule or file pattern has been deliberately accepted:

{
  "version": 1,
  "suppressions": [
    {
      "ruleId": "KAEV-PERF-001",
      "file": "webapp/local/**",
      "reason": "Dataset is contractually limited to 20 local records",
      "expires": "2027-03-31"
    }
  ]
}

Reasons are mandatory. Expired suppressions automatically stop matching. Commit policy files so changes receive normal code review.