false-positives.md

False Positives

BeforeShip is intentionally conservative. Some findings are heuristic and may need review.

Common Cases

Env Files

BeforeShip reports real env files present in the scanned project. This does not prove the file is tracked by git.

Check:

git check-ignore .env
git status --short

Input Validation

BeforeShip looks for recognizable schema/validator patterns such as:

zod, yup, joi, valibot, safeParse, schema.parse, validator

If your project uses a custom validator, the finding may be a false positive.

Rate Limiting

BeforeShip looks for common patterns such as:

rateLimit, limiter, ratelimit, throttle, 429

It also checks nearby local imports from route files.

Webhook Idempotency

BeforeShip recognizes common idempotency patterns:

idempotency
provider event/payment IDs
processed webhook tables
ON CONFLICT DO NOTHING
upsert

If your idempotency logic is hidden behind a custom abstraction, use fixed_when to decide whether the finding is safe to ignore.

Suppression Strategy

v0.1 does not include inline suppressions yet. For now:

• use .beforeshipignore to exclude generated/demo paths
• use beforeship.config.yml scan.exclude for broader exclusions
• prefer improving detector fixtures when a pattern is common