Skip to content

CLI configuration

Ignore generated paths, disable modules, transform findings, and load custom checks.

Use project configuration

VICE reads vice.config.js or vice.config.mjs from the project root. Keep it in version control when the policy should apply consistently to every developer and CI run.

Disable or transform with intent

A transform may return a modified finding or return null to remove it. Prefer a narrow, documented rule over a broad suppression, and keep the original finding when the transform fails.

vice.config.js
1export default {
2  disabledModules: ['git-history'],
3  transformFinding(finding) {
4    return finding
5  },
6}

Ignore non-source paths

Use .viceignore for generated files, vendored code, large fixtures, or other paths that do not belong in the audit. Review an unexpected finding before adding its path.

.viceignore
1**/locales/**
2src/generated/**
3test/fixtures/large/**

Load a custom module

Add module file paths through the modules array. Each ES module must expose a name, value, and async fn implementation that reports findings through the provided context.

Load a project module
1export default {
2  modules: ['./security/custom-check.js'],
3}

Review policy changes

A disabled module, transform, or ignore rule changes coverage. Review those changes like application code and record them with the result when they affect a release gate.

Continue with VICE

Review the open source engine, modules, and scope controls.

Explore the VICE engine