From f35f92ce796c7074d14ac1a6465a16c0d60911c7 Mon Sep 17 00:00:00 2001 From: Gotzon Illarramendi Date: Mon, 25 May 2026 12:12:59 +0200 Subject: [PATCH 1/6] Update docs on suppressed violations --- .../static_analysis/configuration/_index.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/content/en/security/code_security/static_analysis/configuration/_index.md b/content/en/security/code_security/static_analysis/configuration/_index.md index 1f7e0d0c2ba..d810e56bac9 100644 --- a/content/en/security/code_security/static_analysis/configuration/_index.md +++ b/content/en/security/code_security/static_analysis/configuration/_index.md @@ -253,7 +253,11 @@ sast: #### Ignore for a specific instance -To ignore a specific instance of a violation, comment `no-dd-sa` above the line of code to ignore. This prevents that line from ever producing a violation. For example, in the following Python code snippet, the line `foo = 1` would be ignored by Static Code Analysis scans. +To ignore a specific instance of a violation, comment `no-dd-sa` above the line of code to ignore. Rather than omitting the violation entirely, violations suppressed with `no-dd-sa` are shown as **suppressed** so that you can search and audit them. + +In the repository view, suppressed violations appear with `is_suppressed: true`. In the vulnerability explorer, they appear with `status: muted` and `workflow.mute.reason: muted_in_code`. + +For example, in the following Python code snippet, the line `foo = 1` would be suppressed in Static Code Analysis scans. ```python #no-dd-sa @@ -261,11 +265,11 @@ foo = 1 bar = 2 ``` -You can also use `no-dd-sa` to only ignore a particular rule rather than ignoring all rules. To do so, specify the name of the rule you wish to ignore in place of `` using this template: +You can also use `no-dd-sa` to only suppress a particular rule rather than suppressing all rules. To do so, specify the name of the rule you wish to suppress in place of `` using this template: `no-dd-sa:` -For example, in the following JavaScript code snippet, the line `my_foo = 1` is analyzed by all rules except for the `javascript-code-style/assignment-name` rule. +For example, in the following JavaScript code snippet, the line `my_foo = 1` is suppressed only for the `javascript-code-style/assignment-name` rule and is still analyzed by all other rules. ```javascript // no-dd-sa:javascript-code-style/assignment-name From 8de5118e564626155deeebabdf7f99d4728829d3 Mon Sep 17 00:00:00 2001 From: Gotzon Illarramendi Date: Mon, 25 May 2026 22:36:51 +0200 Subject: [PATCH 2/6] Update content/en/security/code_security/static_analysis/configuration/_index.md Co-authored-by: Janine Chan <64388808+janine-c@users.noreply.github.com> --- .../code_security/static_analysis/configuration/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/security/code_security/static_analysis/configuration/_index.md b/content/en/security/code_security/static_analysis/configuration/_index.md index d810e56bac9..99f43ab3b2e 100644 --- a/content/en/security/code_security/static_analysis/configuration/_index.md +++ b/content/en/security/code_security/static_analysis/configuration/_index.md @@ -253,7 +253,7 @@ sast: #### Ignore for a specific instance -To ignore a specific instance of a violation, comment `no-dd-sa` above the line of code to ignore. Rather than omitting the violation entirely, violations suppressed with `no-dd-sa` are shown as **suppressed** so that you can search and audit them. +To ignore a specific instance of a violation, comment `no-dd-sa` above the line of code. Violations suppressed with `no-dd-sa` are shown as **suppressed**, rather than omitted entirely, so you can search and audit them. In the repository view, suppressed violations appear with `is_suppressed: true`. In the vulnerability explorer, they appear with `status: muted` and `workflow.mute.reason: muted_in_code`. From 6e1cce64225610a0d355e53f8ab26b4c7d4e7650 Mon Sep 17 00:00:00 2001 From: Gotzon Illarramendi Date: Mon, 25 May 2026 22:37:03 +0200 Subject: [PATCH 3/6] Update content/en/security/code_security/static_analysis/configuration/_index.md Co-authored-by: Janine Chan <64388808+janine-c@users.noreply.github.com> --- .../code_security/static_analysis/configuration/_index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/en/security/code_security/static_analysis/configuration/_index.md b/content/en/security/code_security/static_analysis/configuration/_index.md index 99f43ab3b2e..8942a4f8174 100644 --- a/content/en/security/code_security/static_analysis/configuration/_index.md +++ b/content/en/security/code_security/static_analysis/configuration/_index.md @@ -277,6 +277,8 @@ my_foo = 1 myBar = 2 ``` +[1]: https://app.datadoghq.com/security/code-security/repositories +[2]: https://app.datadoghq.com/security/code-security/sca [6]: /security/code_security/static_analysis/static_analysis_rules [25]: https://github.com/DataDog/datadog-static-analyzer/blob/main/doc/legacy_config.md [26]: /security/code_security/guides/configuration/ From 7e19f005662c5f800fefefbee3fa90a9e280c51e Mon Sep 17 00:00:00 2001 From: Gotzon Illarramendi Date: Mon, 25 May 2026 22:37:27 +0200 Subject: [PATCH 4/6] Update content/en/security/code_security/static_analysis/configuration/_index.md Co-authored-by: Janine Chan <64388808+janine-c@users.noreply.github.com> --- .../code_security/static_analysis/configuration/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/security/code_security/static_analysis/configuration/_index.md b/content/en/security/code_security/static_analysis/configuration/_index.md index 8942a4f8174..2cab1a10183 100644 --- a/content/en/security/code_security/static_analysis/configuration/_index.md +++ b/content/en/security/code_security/static_analysis/configuration/_index.md @@ -255,7 +255,7 @@ sast: To ignore a specific instance of a violation, comment `no-dd-sa` above the line of code. Violations suppressed with `no-dd-sa` are shown as **suppressed**, rather than omitted entirely, so you can search and audit them. -In the repository view, suppressed violations appear with `is_suppressed: true`. In the vulnerability explorer, they appear with `status: muted` and `workflow.mute.reason: muted_in_code`. +On the [Repositories page][1], suppressed violations appear with `is_suppressed: true`. In the [Vulnerabilities explorer][2], they appear with `status: muted` and `workflow.mute.reason: muted_in_code`. For example, in the following Python code snippet, the line `foo = 1` would be suppressed in Static Code Analysis scans. From 2ae245612736ec871f98dcf7e104afab4b782d5c Mon Sep 17 00:00:00 2001 From: Gotzon Illarramendi Date: Mon, 25 May 2026 22:37:45 +0200 Subject: [PATCH 5/6] Update content/en/security/code_security/static_analysis/configuration/_index.md Co-authored-by: Janine Chan <64388808+janine-c@users.noreply.github.com> --- .../code_security/static_analysis/configuration/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/security/code_security/static_analysis/configuration/_index.md b/content/en/security/code_security/static_analysis/configuration/_index.md index 2cab1a10183..6ea600a30c4 100644 --- a/content/en/security/code_security/static_analysis/configuration/_index.md +++ b/content/en/security/code_security/static_analysis/configuration/_index.md @@ -265,7 +265,7 @@ foo = 1 bar = 2 ``` -You can also use `no-dd-sa` to only suppress a particular rule rather than suppressing all rules. To do so, specify the name of the rule you wish to suppress in place of `` using this template: +You can also use `no-dd-sa` to only suppress a particular rule, rather than suppressing all rules. To do so, specify the name of the rule you wish to suppress in place of `` using this template: `no-dd-sa:` From 6118a2bada5d153eb15134cdce870be80fdc83c0 Mon Sep 17 00:00:00 2001 From: Gotzon Illarramendi Date: Mon, 25 May 2026 22:38:09 +0200 Subject: [PATCH 6/6] Update content/en/security/code_security/static_analysis/configuration/_index.md Co-authored-by: Janine Chan <64388808+janine-c@users.noreply.github.com> --- .../code_security/static_analysis/configuration/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/security/code_security/static_analysis/configuration/_index.md b/content/en/security/code_security/static_analysis/configuration/_index.md index 6ea600a30c4..bc2027ed3fa 100644 --- a/content/en/security/code_security/static_analysis/configuration/_index.md +++ b/content/en/security/code_security/static_analysis/configuration/_index.md @@ -269,7 +269,7 @@ You can also use `no-dd-sa` to only suppress a particular rule, rather than supp `no-dd-sa:` -For example, in the following JavaScript code snippet, the line `my_foo = 1` is suppressed only for the `javascript-code-style/assignment-name` rule and is still analyzed by all other rules. +For example, in the following JavaScript code snippet, the line `my_foo = 1` is suppressed only for the `javascript-code-style/assignment-name` rule, but all other rules still analyze it. ```javascript // no-dd-sa:javascript-code-style/assignment-name