> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iriscode.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Inline suppressions: silence a finding with a documented reason

> Silence one finding on one line without switching the rule off, and write down why you did it.

A suppression tells Iris Code to ignore a particular finding that you have reviewed and accepted. It is useful when a reported pattern is intentional, such as a test credential that is not a real secret. Keep suppressions narrow so other problems in the same file are still reported.

## Writing one

Put the comment on the line directly above:

```typescript theme={null}
// iris-ignore: console-log -- CLI entry point, intentional user output
console.log(`Report written to ${outputPath}`)

// iris-ignore: any-usage, long-param-list -- third-party callback shape we do not control
function onLegacyEvent(payload: any, a: string, b: string, c: string, d: string, e: string) {
```

Python uses `#`:

```python theme={null}
# iris-ignore: insecure-random -- shuffling a UI carousel, not security-sensitive
index = random.randint(0, len(slides) - 1)
```

For a whole file, put `iris-ignore-file` anywhere in it:

```typescript theme={null}
// iris-ignore-file: console-log -- this whole module is a debug logger
```

The shape is the same either way:

```
// iris-ignore: <ruleId>[, <ruleId>...] -- <reason>
```

One or more rule ids, then `--`, then a reason.

## The reason isn't optional

Leave the reason out, misspell the rule id, or name no rule at all, and the directive **suppresses nothing**. It gets reported as a **Bare Ignore** with its own score penalty instead.

```typescript theme={null}
// iris-ignore: console-log            <- no reason: suppresses nothing, costs points
// iris-ignore: consol-log -- typo     <- unknown rule: suppresses nothing, costs points
// iris-ignore: console-log -- CLI output   <- works
```

This is deliberate. A suppression that costs nothing and explains nothing becomes a mute button rather than a decision, and months later there is no way to tell whether the `any` was reasoned about or simply inconvenient. Penalising an undocumented one keeps the mechanism meaningful.

## What you can suppress

Eighteen rules, which is every finding that points at a specific line:

| Rule id | Finding |
| - | - |
| `console-log` | Console or debug print |
| `todo` | `TODO` / `FIXME` / `HACK` |
| `magic-number` | Raw numeric literal |
| `long-param-list` | Long parameter list |
| `unused-var` | Unused variable |
| `unused-function` | Unused function |
| `hardcoded-secret` | Hardcoded credential |
| `eval-usage` | `eval()` / `exec()` |
| `sql-concatenation` | SQL built by string concatenation |
| `insecure-random` | Non-cryptographic RNG |
| `unsafe-regex` | ReDoS-prone regex |
| `hardcoded-localhost` | Hardcoded localhost URL |
| `disabled-tls-verification` | TLS verification switched off |
| `debug-flags-enabled` | Debug flag in production code |
| `weak-hashing` | MD5 or SHA-1 |
| `open-redirect` | Unvalidated redirect |
| `any-usage` | Explicit `any` |
| `function-too-long` | Function over the length threshold |
| `duplicate-code` | Duplicated block |
| `file-naming` | Filename against the configured convention |
| `method-missing` | Ruby: `method_missing` without `respond_to_missing?` |
| `god-class` | Ruby: class over the method limit |
| `mass-assignment` | Ruby: Rails params without `require`/`permit` |
| `large-class` | C#: type over the method limit or the length threshold |
| `catch-all-exception` | C# and Java: `catch (Exception)`, `catch (Throwable)`, or a bare `catch` |
| `async-void` | C#: `async void` outside an event handler |
| `linq-abuse` | C#: five or more LINQ operators in one statement |
| `process-execution` | Java: `Runtime.exec` or `ProcessBuilder` |
| `unwrap-abuse` | Rust: `unwrap` or `expect` outside test code |
| `explicit-panic` | Rust: `panic!`, `todo!`, or `unimplemented!` outside test code |

Findings that aren't about a line can't be suppressed: file too long, too many functions, too many imports, and parse errors. Those always count.

## What it does to your score

A suppressed finding stops costing points, since the score is recalculated after suppressions are applied. It does not disappear, though: it stays counted and listed in both the sidebar and CLI output, so a project accumulating suppressions is visibly doing so.

A bare ignore does the opposite: it suppresses nothing and takes points off, 2 by default, adjustable in [Scoring Weights](/configuration/scoring-weights).

## Where you see them

**File tab** has a collapsible **Suppressed** section under Code Smells, with each rule, line and reason. Bare ignores show up as their own smell row.

**Workspace and Folder tabs** show suppressed and bare counts plus the worst offending files. **See all** opens the full table for the last scan, filterable, with click-to-open.

**The CLI** always prints the count. `--show-suppressed` lists them:

```bash theme={null}
iris check src/ --show-suppressed
iris gate --show-suppressed
```

`--format json` includes a per-file `suppressed` array with the rule, line and reason.

## Keeping a lid on it (Pro)

Two fields in `.irisconfig.json`:

```json theme={null}
{
  "gateMaxSuppressions": 5,
  "ignoreSuppressions": false
}
```

| Key | What it does |
| - | - |
| `gateMaxSuppressions` | Caps suppressions per file. Go over it and the file fails the gate, in `iris gate`, the pre-push hook and the build hook alike. |
| `ignoreSuppressions` | The kill switch. Set it to `true` and every directive goes inert, so suppressed findings count as live again. Useful for an audit, or when suppressions have clearly become a way around the gate rather than a record of decisions. |

The `strict` and `security` presets already set a cap (5 and 3 per file) and a heavier bare-ignore penalty (3 and 4). The other presets leave it unset, so there's no limit until you set one.

<Tip>
  Commit `.irisconfig.json` with `gateMaxSuppressions` set and the cap applies to everyone. Without it, a file can be brought under the gate by suppression rather than by fixing anything. See [Gate thresholds](/configuration/irisconfig#gate-thresholds).
</Tip>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.