Ignore false positives from the report

SAFE has an advanced false positive filtering mechanism that tries to identify and ignore known false positives in the codebase, reducing noise in the reports. Even with this mechanism, there might be cases where certain findings are still considered false positives. In such cases, you can use our ignore mechanism to explicitly ignore certain findings.

Ignoring a finding

To ignore a finding, you need to put a specific comment in the source code, right above the line where the vulnerability is detected.

The comment marker depends on the language:

Language	Comment form
Erlang	% safe-ignore ...
Elixir	# safe-ignore ...
Gleam	// safe-ignore ...

The safe-ignore phrase is case-insensitive — SAFE-IGNORE works just as well as safe-ignore.

Example in Erlang

my_function() ->
    ...
    % safe-ignore list_to_atom/1
    list_to_atom(CheckedVariable),
    ...

Example in Elixir

def my_function do
    ...
    # safe-ignore String.to_atom/1
    String.to_atom(checked_variable)
    ...
end

Example in Gleam

// safe-ignore binary_to_atom/1
pub fn handle_request(user_input: String) -> atom.Atom {
  atom.create(user_input)
}

Gleam has two rules of its own:

• The comment goes immediately above the function declaration, not above the offending line — that is where SAFE anchors Gleam findings, so it suppresses every matching finding in that function. Nothing may come between it and pub fn, so on an @external function it belongs between the attribute and the declaration.
• Name the Erlang function, not the Gleam one. atom.create/1 is reported as erlang:binary_to_atom/1, so // safe-ignore atom.create/1 never matches. Take the name from the finding's vulnerable_fun.

All of these forms match a finding:

Form	Example	When it works
Erlang style	safe-ignore erlang:binary_to_atom/1	always
Dotted style	safe-ignore erlang.binary_to_atom/1	always
Bare function	safe-ignore binary_to_atom/1	only for the erlang and Kernel modules

A finding reported as crypto:hash/2 therefore needs the module: a bare safe-ignore hash/2 will not match. A comment naming a function SAFE did not report simply never matches — the finding stays in the report, with no warning.