MAGDOX Code Security documentation

Configuration

The project file, organisation policy, and precedence between them.

Status: Preview

Project settings live in one file committed with the repository, so everyone scans the same scope. Organisation settings, including snippet policy, retention and pinned checks, live in the dashboard and take precedence where they are pinned.

Placeholder: project file

yamlplaceholder
# .magdox.yml (schema not final)
project: example-service
include: [src, services]
exclude: [vendor, node_modules, test/fixtures]
checks: [sast, dependencies, secrets, configuration, sbom, cbom]
baseline: main
fail_on:
  new_findings_at_or_above: high
report:
  local_dir: ./magdox-report
  formats: [html, json]
upload:
  enabled: true          # false is the same as --local-only
  snippets: inherit      # off | redacted | full, capped by organisation policy

Precedence

  • Command-line flags override the project file.
  • The project file overrides organisation defaults.
  • Pinned organisation policy overrides both. For example, if snippets are pinned to off, no project can enable them.

Validate

bashplaceholder
magdox config validate
magdox scan --show-payload --local-only
Reports and exportsCI integration