Scoped shipping-path scans

A browser full-tree scan of a large repo can emit tens of thousands of findings, including credential echoes inside demo reports and *.simplebeacon-backup.* snapshots. That inventory is not the shipping gate. Do not drop a 15 MB+ JSON file on Roadmap (the dropzone rejects it). Do not treat a FAIL full-tree report as PASS.

The CLI does not accept --production-paths or --ignore-paths. Scope is scanPaths, productionPaths, and ignore in a config file, plus optional --exclude on the command line. Fail-on is --fail-on critical,high or gate.failOn in config — not an include / exclude pair at the JSON root.

1. Config file

Example profile used for this monorepo (no fullDirectoryScan). Paths are repository-relative. There is no repo-root src/ here; CLI source is packages/simplebeacon-cli/src. Catalog file scanner-patterns.js is ignored so the gate does not fail on its own rule text. 

{
  "profile": "eu-ai-act",
  "fullDirectoryScan": false,
  "scanPaths": [
    "coming-soon/routes",
    "coming-soon/public/js-es2018",
    "packages/simplebeacon-cli/src"
  ],
  "productionPaths": [
    "coming-soon/routes",
    "coming-soon/public/js-es2018",
    "packages/simplebeacon-cli/src"
  ],
  "ignore": [
    "demo/**",
    "**/demo/**",
    "**/*simplebeacon-backup*",
    "**/assets/**",
    "**/dist/**",
    "**/node_modules/**",
    "**/*.min.js",
    "coming-soon/public/js-es2018/dashboard/scanner-patterns.js",
    "**/js-es2018/dashboard/scanner-patterns.js"
  ]
}

Save as .simplebeacon/config-shipping-paths.json at the repository root.

2. Command

npx simplebeacon scan \
  --config .simplebeacon/config-shipping-paths.json \
  --gate \
  --offline \
  --format json \
  --output .simplebeacon/production-report.json \
  --exclude demo,assets,dist,node_modules,simplebeacon-backup \
  --fail-on critical,high

Read gate.pass and issueCount on that output file. Medium and low findings do not fail this fail-on policy.

3. Roadmap ingest

Security & trust · Roadmap