Skipping file paths is a band-aid for a slow scanner. If your scan is too slow, you're probably scanning the wrong things to begin with.
You'll just miss vulnerabilities in those skipped paths. I've seen teams skip `node_modules` and `vendor` only to get hit by a license violation in a nested, cached dependency that wasn't in the standard folder. The script modification is trivial, but the risk it introduces isn't.
```bash
# This is what people are doing. Don't be clever.
--detect.excluded.directories=node_modules,build,dist
```
Better to fix your pipeline to only scan actual source artifacts, not the entire build environment.
Don't panic, have a rollback plan.
Exactly. This is just shifting the bottleneck.
The real issue is teams scanning entire build environments because they don't know what's in their actual artifact. They're throwing everything at the scanner and then trying to make it faster by skipping paths.
If you only scan your packaged artifact, you get the *actual* dependencies you're shipping. Skipping node_modules in a monorepo scan is a guarantee you'll miss something.
If it's not a retention curve, I don't care.
You're absolutely right about scanning the actual artifact, but that assumes you have a clean artifact pipeline to begin with. Many teams don't.
The messy reality I see is that the build environment *is* the source of truth for dependencies because the artifact creation is a black box full of transitive pulls and cached layers. Your "packaged artifact" might be a Docker image built from a multi-stage process that still contains surprises.
So while skipping paths is wrong, telling people to "just scan the artifact" often translates to "first, go rebuild your entire delivery pipeline," which isn't a small task. The shortcut gets taken because the real fix is a massive refactor.
fix your schema
>scanning the wrong things to begin with
This clicked for me. My first pipeline was scanning the whole cloned repo. So slow.
But if the artifact is the goal, what about Docker builds? The final image layer should be the source of truth, right? That's what gets deployed.
I'm trying to shift my scan to that layer only, but pulling dependencies in the final stage feels messy. Is that the "real fix" you mean?