Inline suppressions: silence a finding with a documented reason

A suppression tells Iris Code to ignore a particular finding that you have reviewed and accepted. It is useful when a reported pattern is intentional, such as a test credential that is not a real secret. Keep suppressions narrow so other problems in the same file are still reported.

Writing one

Put the comment on the line directly above:

// iris-ignore: console-log -- CLI entry point, intentional user output
console.log(`Report written to ${outputPath}`)

// iris-ignore: any-usage, long-param-list -- third-party callback shape we do not control
function onLegacyEvent(payload: any, a: string, b: string, c: string, d: string, e: string) {

Python uses #:

# iris-ignore: insecure-random -- shuffling a UI carousel, not security-sensitive
index = random.randint(0, len(slides) - 1)

For a whole file, put iris-ignore-file anywhere in it:

// iris-ignore-file: console-log -- this whole module is a debug logger

The shape is the same either way:

// iris-ignore: <ruleId>[, <ruleId>...] -- <reason>

One or more rule ids, then --, then a reason.

The reason isn’t optional

Leave the reason out, misspell the rule id, or name no rule at all, and the directive suppresses nothing. It gets reported as a Bare Ignore with its own score penalty instead.

// iris-ignore: console-log            <- no reason: suppresses nothing, costs points
// iris-ignore: consol-log -- typo     <- unknown rule: suppresses nothing, costs points
// iris-ignore: console-log -- CLI output   <- works

This is deliberate. A suppression that costs nothing and explains nothing becomes a mute button rather than a decision, and months later there is no way to tell whether the any was reasoned about or simply inconvenient. Penalising an undocumented one keeps the mechanism meaningful.

What you can suppress

Eighteen rules, which is every finding that points at a specific line:

Rule id	Finding
`console-log`	Console or debug print
`todo`	`TODO` / `FIXME` / `HACK`
`magic-number`	Raw numeric literal
`long-param-list`	Long parameter list
`unused-var`	Unused variable
`unused-function`	Unused function
`hardcoded-secret`	Hardcoded credential
`eval-usage`	`eval()` / `exec()`
`sql-concatenation`	SQL built by string concatenation
`insecure-random`	Non-cryptographic RNG
`unsafe-regex`	ReDoS-prone regex
`hardcoded-localhost`	Hardcoded localhost URL
`disabled-tls-verification`	TLS verification switched off
`debug-flags-enabled`	Debug flag in production code
`weak-hashing`	MD5 or SHA-1
`open-redirect`	Unvalidated redirect
`any-usage`	Explicit `any`
`function-too-long`	Function over the length threshold
`duplicate-code`	Duplicated block
`file-naming`	Filename against the configured convention
`method-missing`	Ruby: `method_missing` without `respond_to_missing?`
`god-class`	Ruby: class over the method limit
`mass-assignment`	Ruby: Rails params without `require`/`permit`
`large-class`	C#: type over the method limit or the length threshold
`catch-all-exception`	C# and Java: `catch (Exception)`, `catch (Throwable)`, or a bare `catch`
`async-void`	C#: `async void` outside an event handler
`linq-abuse`	C#: five or more LINQ operators in one statement
`process-execution`	Java: `Runtime.exec` or `ProcessBuilder`
`unwrap-abuse`	Rust: `unwrap` or `expect` outside test code
`explicit-panic`	Rust: `panic!`, `todo!`, or `unimplemented!` outside test code

Findings that aren’t about a line can’t be suppressed: file too long, too many functions, too many imports, and parse errors. Those always count.

What it does to your score

A suppressed finding stops costing points, since the score is recalculated after suppressions are applied. It does not disappear, though: it stays counted and listed in both the sidebar and CLI output, so a project accumulating suppressions is visibly doing so. A bare ignore does the opposite: it suppresses nothing and takes points off, 2 by default, adjustable in Scoring Weights.

Where you see them

File tab has a collapsible Suppressed section under Code Smells, with each rule, line and reason. Bare ignores show up as their own smell row. Workspace and Folder tabs show suppressed and bare counts plus the worst offending files. See all opens the full table for the last scan, filterable, with click-to-open. The CLI always prints the count. --show-suppressed lists them:

iris check src/ --show-suppressed
iris gate --show-suppressed

--format json includes a per-file suppressed array with the rule, line and reason.

Keeping a lid on it (Pro)

Two fields in .irisconfig.json:

{
  "gateMaxSuppressions": 5,
  "ignoreSuppressions": false
}

Key	What it does
`gateMaxSuppressions`	Caps suppressions per file. Go over it and the file fails the gate, in `iris gate`, the pre-push hook and the build hook alike.
`ignoreSuppressions`	The kill switch. Set it to `true` and every directive goes inert, so suppressed findings count as live again. Useful for an audit, or when suppressions have clearly become a way around the gate rather than a record of decisions.

The strict and security presets already set a cap (5 and 3 per file) and a heavier bare-ignore penalty (3 and 4). The other presets leave it unset, so there’s no limit until you set one.

Commit .irisconfig.json with gateMaxSuppressions set and the cap applies to everyone. Without it, a file can be brought under the gate by suppression rather than by fixing anything. See Gate thresholds.

Start here

What Iris Code finds

Blocking bad code

Refactor playbook

Cloud scanning

Teams

Configuration

Working with AI agents

Editors

Reference

Inline suppressions: silence a finding with a documented reason

Writing one

The reason isn’t optional

What you can suppress

What it does to your score

Where you see them

Keeping a lid on it (Pro)

​Writing one

​The reason isn’t optional

​What you can suppress

​What it does to your score

​Where you see them

​Keeping a lid on it (Pro)

Writing one

The reason isn’t optional

What you can suppress

What it does to your score

Where you see them

Keeping a lid on it (Pro)