DHIVA LABS · LEARN

Appearance

Baselines ​

The first scan of an older project often finds many problems at once. A baseline records today's findings, so later scans report and fail only on findings that are new.

How a baseline works ​

A baseline is a JSON file that lists the stable ids of the findings in one scan. When you scan with that file, findings whose id is in it are set aside. The report shows only the new ones, and the exit code is based only on the new ones.

The file holds ids, not code or secret values.

Create a baseline ​

  1. From the project root, run:

    bash
    sentinel baseline .

  2. DL Sentinel scans the folder and writes .sentinel-baseline.json. A line on the screen says how many findings it recorded.

  3. Commit the file, so that everyone and your CI use the same baseline:

    bash
    git add .sentinel-baseline.json
git commit -m "Add DL Sentinel baseline"

sentinel baseline always exits 0 when it writes the file. It does not apply the policy. Findings hidden by suppress entries in sentinel.yml are not recorded.

To write the file somewhere else:

bash
sentinel baseline . --output security/baseline.json

Scan against the baseline ​

bash
sentinel scan . --baseline .sentinel-baseline.json

The summary gains a line such as New: 2 (Baselined: 40). Only the 2 new findings appear in full reports, and only they can make the scan exit 1.

Update the baseline ​

When you have fixed old findings, or accepted new ones, write a fresh baseline. You can scan and rewrite in one command:

bash
sentinel scan . --baseline .sentinel-baseline.json --write-baseline .sentinel-baseline.json

The report still shows only new findings, while the rewritten file records every current finding.

Baseline or suppression? ​

UseWhen
A baselineYou have a backlog of old findings and want to stop new ones while you work through it
A suppress entryYou have reviewed one finding, or one kind of finding in some files, and decided it is acceptable

Suppressions live in sentinel.yml, carry a reason and can expire. A baseline is a snapshot that you regenerate. See Configure scans.

WARNING

A baseline hides real problems from the report. It does not fix them. Plan to work through the baselined findings, starting with critical and high ones.

Errors ​

If the baseline file is missing, is not JSON or is not a DL Sentinel baseline, the scan stops with exit code 64 before scanning. The file's contents are never printed in the error.

Next steps ​