For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/code_security/software_composition_analysis/configuration.md. A documentation index is available at /llms.txt.

Software Composition Analysis (SCA) Configuration

This product is not supported for your selected Datadog site. ().

Datadog Software Composition Analysis (SCA) detects open source libraries and their vulnerabilities in your code. You can exclude specific paths, ecosystems, or packages from Static SCA analysis. Configure these settings under the sca key in the Code Security configuration, either in Datadog or in a code-security.datadog.yaml file.

The sca key was introduced in schema-version: v1.1 and supports the following fields. Each field has its own minimum schema-version, so use the highest version required by the fields you configure:

PropertyTypeDescriptionDefaultMinimum schema-version
ignore-pathsArrayFile paths or glob patterns to exclude from Static SCA analysis.Nonev1.1
ignore-ecosystemsArrayEcosystems, such as npm, Go, PyPI, to exclude from Static SCA analysis.Nonev1.7
ignore-packagesArrayPackages to exclude from Static SCA analysis, regardless of version. Each entry uses the <ecosystem>:<name> format, such as npm:lodash.Nonev1.7

Example:

schema-version: v1.7
sca:
  ignore-paths:
    - "vendor/"
    - "**/node_modules/**"
    - "third_party/"
  ignore-ecosystems:
    - "npm"
  ignore-packages:
    - "Go:golang.org/x/text"
Ecosystem and package names in ignore-ecosystems and ignore-packages are matched case-sensitively. For example, go:golang.org/x/text does not match the Go ecosystem, and npm:Lodash does not match the lodash package.

If you run the SCA scanner directly from the CLI, the equivalent --exclude, --exclude-ecosystem, and --exclude-package flags are unioned with the exclusions configured above.

For more information on configuration locations, precedence, and merging, see Code Security Configuration Reference.

Further Reading

Additional helpful documentation, links, and articles:

Software Composition AnalysisDOCUMENTATION more more Code Security Configuration ReferenceDOCUMENTATION more more