Configuration

stoa.toml in the repository root. All values shown are defaults.

fail_on = "none"          # gate on all findings at/above this severity
fail_on_new = "critical"  # gate on newly introduced findings (with --base)
max_file_bytes = 1000000
follow_symlinks = false
respect_gitignore = true

ignore_paths = ["tests/snapshots/**"]

[severity]                # per-rule severity overrides
NET001 = "info"

[rules]                   # per-rule enable/disable
CTRL003 = false

[gate]                    # opt extra rules into the gate (beyond AI002 exec)
additional_rules = ["AI001"]

[rules.AI006]             # org-approved network egress destinations
allowed_hosts = ["api.internal.corp", "hooks.slack.com"]

[rules.AI004]             # extra PII identifiers to match
pii_terms = ["employee_id", "account_number"]

[dimensions]              # replace the default dimension taxonomy
taxonomy = ".stoa/dimensions.toml"

Suppression

Inline, rule-scoped, with a reason:

query = f"SELECT * FROM {table}"  # stoa: ignore[SEC003] trusted enum

Also # stoa: ignore-file[CTRL001], .stoaignore path patterns, and per-rule toggles above. Suppressed findings are always counted and shown — never hidden.

.stoaignore

Gitignore-style path exclusions. Tests and fixtures are not ignored by default (secret scanning is still useful there) but are downweighted for agent detection.