Project rules

Hacktron can use repository-specific context when it reviews pull requests. Add a .hacktron/rules.md file that describes the conventions that matter in your application. Rules help Hacktron adapt its reviews to your codebase and report fewer false positives, without ignoring real vulnerabilities.

What to include

Use rules to explain:

• internal authentication and authorisation patterns

• trusted services, domains, and data sources

• context outside the code that affects exploitability, such as firewalls or network configuration that isn’t in infrastructure as code

• files or types of vulnerabilities Hacktron should ignore

File location

Place the file in the .hacktron directory at the root of the repository:

.hacktron/
  rules.md
apps/
packages/
package.json
pnpm-lock.yaml

Commit .hacktron/rules.md to the branch Hacktron reviews, such as your default branch.

Example

1
- Users with the `admin` role are assumed to be trusted and should be exempt from access control checks.
2
- Do not report XSS vulnerabilities in admin pages, but report them in user-facing pages.
3
- Requests from `internal-api.local` are trusted service-to-service calls.
4
- Payment flows under `src/billing/**` are high risk and should be reviewed strictly.

Related

.hacktron/config.yaml is a separate file: it excludes pull requests from scanning and fails the check on findings. Repository configuration covers it.