Skip to main content
Rule ID: AE-SUPPRESS-001 · Severity: Medium · Category: Governance · Auto-fixable: No

​
Why this rule

A suppression without a reason is indistinguishable from accident. When a finding re-surfaces after a security review or team rotation, there is no record of why it was acceptable or who decided. Suppressions are a legitimate tool for managing accepted risk — but only when the decision is documented. A reason-less suppression creates a silent blind spot that grows harder to audit over time. See Suppression governance for the full model.

​
What triggers it

Charter audits every suppression that was applied during the current scan:
  • All entries in .charter-suppress.yml
  • Every inline # charter:ignore comment that matched a finding
For each applied suppression, Charter checks whether a reason field is present and non-empty. Both of these fire the finding:
  • A YAML entry with no reason: key
  • An inline directive with no reason="…" segment
The suppression itself still takes effect — Charter continues to suppress the underlying finding. A missing reason is a governance hygiene problem, not grounds to un-suppress. The deduction is applied to the score, not the original finding.

​
Examples

A .charter-suppress.yml entry with no reason field:
.charter-suppress.yml
An inline directive with no reason:
internal/scanner.go

​
How to fix

1

Find reason-less suppressions

Run charter explain with AE-SUPPRESS-001 — Charter names the suppressed rule and its source file (YAML entry or inline comment location) in the finding evidence.
2

Add a meaningful reason

For YAML entries, add a reason: field. For inline comments, add reason="…" after the rule ID. Use plain language — a sentence is enough.
3

Use charter suppress for new entries

The charter suppress command always writes the reason for you when you provide --reason. The rule ID is positional:
A good reason answers: “Why is this finding acceptable in this repo, specifically?” Generic reasons like “not applicable” or “known issue” are technically valid but provide no value to future reviewers.

​
Score impact

Medium (−4 per finding). No hard cap — caps are reserved for raw-secret and Blocker findings. One finding per reason-less suppression entry. See Scoring and caps.

​
Edge cases

A suppression entry whose rule never matched any finding this scan — but which is still non-expired — is still audited for a reason field. Expired entries are inert and not evaluated.
An inline # charter:ignore comment that matched no finding is not audited. Inline directives are discovered only at finding locations.
A reason: field containing only spaces or tabs counts as missing and fires the finding.
Secrets are suppressible like any rule. A reason-less AE-SEC-001 or AE-SEC-002 suppression is audited exactly the same way as any other rule.

AE-SUPPRESS-002

Requires an approver on permanent suppressions — the accountability companion to this rule.

AE-SUPPRESS-003

Informational — surfaces when the overall suppression rate is high.

​
CLI