Add a grype.yaml File to Cut Vulnerability Scan Noise in Your Projects

Security teams and developers often clash over excessive vulnerability alerts generated by Grype, a container and filesystem scanning tool. A practical solution involves adding a .grype.yaml configuration file to the root directory of a project. This file allows teams to explicitly ignore CVEs that are non-applicable or platform-specific, such as Windows-only vulnerabilities flagged inside Linux-based images. The approach was identified while deploying Bookstack in a local environment and reflects a broader challenge faced by organizations managing software supply chain security. By filtering out false positives, teams can reduce alert fatigue and improve collaboration between development and security functions.