Hi everyone. I'm in the middle of a compliance push and our Mend reports are getting flagged for vulnerabilities in packages that are only used during development or build time (think testing frameworks, linting tools, build scripts). These don't ship to production, so they're creating a lot of noise and extra work for the security team.
I know we can manually approve them, but that's not scalable. I'm looking for a way to systematically filter these dev dependencies out of our main vulnerability reports, or at least have them tagged differently. We're primarily using Mend with our Node.js and Python projects.
What I've tried/considered so far:
* Looking for a global setting in the Mend UI to ignore dependencies flagged as "dev" in package.json or dev_requires in setup.py. No luck.
* I've seen references to policies and tags, but the documentation feels more geared toward post-discovery filtering rather than preventing the noise upfront.
* I know some teams just accept the noise and handle it in their review process, but I'd prefer a cleaner separation.
Has anyone set up a working filter or policy for this? I'm especially interested in:
* Whether you used the Mend UI, API, or a configuration file within your repos.
* If you tag dependencies based on ecosystem (npm, pip) and then filter reports.
* Any pitfalls you ran into—like a "dev" dependency that actually *does* end up in a production bundle somehow.
Our goal is to have clear, actionable reports for runtime dependencies, and a separate, less critical view for toolchain vulnerabilities. Any detailed experiences would be a huge help.
Data is sacred.