false-positive-rules

name	false-positive-rules
description	Rules for auto-dismissing code review findings that are false positives

False Positive Rules (Auto-Dismiss)

Apply these rules to ALL findings. If a finding matches ANY rule, DISMISS it.

1. CI-Controlled Variables

ANY finding about these variables -- they aren't attacker-controlled in CI context:

• CI_* (CI_PROJECT_ID, CI_MERGE_REQUEST_IID, CI_JOB_TOKEN, etc.)
• GITLAB_* (GITLAB_USER_LOGIN, etc.)
• PROJECT_*, MR_* variables set by CI
• Environment variables set by deployment scripts or CDK

2. Intentional CI/Automation Flags

These are required for CI automation, not security issues:

• --dangerously-skip-permissions (required for non-interactive CI)
• --output-format text (standard CI output)
• --print with MCP servers
• --no-verify in CI pipeline contexts
• Feature flags and toggles that are intentional

3. Ephemeral CI Context

CI jobs run in isolated, ephemeral containers:

• Token permissions (CI tokens are scoped and ephemeral)
• File permissions in /tmp or CI workspace directories
• MCP server access (uses CI token context, not persistent)
• World-readable files in CI workspace (container is isolated)
• Temporary credentials with automatic rotation

4. Theoretical Risks

Dismiss findings that match these patterns:

• "Could be exploited if..." with no practical attack path
• Race conditions with no real-world trigger
• Missing validation where input is already validated upstream
• Performance concerns in cold-start-only paths
• Complexity complaints about necessarily complex logic

5. Already-Enforced Constraints

• Issues caught by linters/formatters (ESLint, Prettier, tsc)
• Issues caught by existing CI checks (tests, type checks)
• Issues in auto-generated code (packages/generated/)
• CDK nag suppressions that already have documented justification

The Senior Engineer Test

If you're unsure, apply this test: "Would a senior engineer reviewing this MR request this change?" If the answer is "probably not", DISMISS IT.

Also ask: "Is this finding actionable and specific?" If the finding is vague or the fix is unclear, DISMISS.