---
id: scan-suppression-markers
track: coding
version: 0.0.2
label: asks
keyword: ask
where: write turn-end
sha256: 64c5944220188b4169dd26b343224668f080b1bba17882b6da2609919b2c90d9
source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/scan-suppression-markers
catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f
---

# Review Added Scanner Suppressions

scan-suppression-markers · version 0.0.2

Asks — Asks on an agent's file writes and at turn end. Chock adds friction. It is not a security boundary. 

In a git repo: at commit (Chock refuses the commit, locally and in CI.)



## What it does

Asks a person before a change adds a scanner suppression: inline ignore markers (bandit, gosec, ruff S codes, Sonar, Semgrep, ESLint security, Checkov, tfsec, Trivy, KICS, hadolint, cfn_nag, zizmor, gitleaks, detect-secrets, CodeQL, Java/C#/Rust security allows), scanner ignore files and skip keys, a CI scan set to pass on failure. Only added lines; prose skipped. Runs: commit, agent write, turn's end; CI annotates. Line-local, friction not a boundary.

## Its label on each agent

- Claude Code (tested): Asks — Asks on an agent's file writes and at turn end. Builder: /coding/builder/#client=claude-code&p=scan-suppression-markers
- Cursor (tested): Blocks — Refuses an agent's file writes and refuses at turn end, because this client cannot prompt at either point. Builder: /coding/builder/#client=cursor&p=scan-suppression-markers
- Codex (tested): Blocks — Refuses an agent's file writes and refuses at turn end, because this client cannot prompt at either point. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=codex&p=scan-suppression-markers
- GitHub Copilot (tested): Blocks — Refuses at turn end only, because this client cannot prompt there. It does not check a file write when it happens. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=copilot&p=scan-suppression-markers
- Devin (tested): Blocks — Refuses at turn end only, because this client cannot prompt there. It does not check a file write when it happens. If the hook errors, the action goes through (vendor docs only, not witnessed). Builder: /coding/builder/#client=devin&p=scan-suppression-markers
- Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=scan-suppression-markers
- goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=scan-suppression-markers
- Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=scan-suppression-markers
- OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=scan-suppression-markers
- Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=scan-suppression-markers
- Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=scan-suppression-markers

## What it misses

This policy does not state what it misses.

## Examples

- Asks: A commit adds a bandit nosec comment to a subprocess call.
- Allowed: A commit adds ordinary Python code with an unrelated noqa.

## Latest change

0.0.2 · 2026-10-27 — Title wording only (IR-F40): "Scan Suppression Markers" is now "Review Added Scanner Suppressions". The id, guard and tests are unchanged.

## Provenance

- Tested by 44 of 45 cases run automatically
- SHA-256: `64c5944220188b4169dd26b343224668f080b1bba17882b6da2609919b2c90d9`
- Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f
- Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/scan-suppression-markers (catalog path `base/scan-suppression-markers`)
- Presets: Code hardening
- JSON: `/api/coding/policies/scan-suppression-markers.json`
- Report a problem: https://chock.sh/report/?policy=scan-suppression-markers&version=0.0.2&page=%2Fcoding%2Fpolicies%2Fscan-suppression-markers%2F