Configuration

CODYGIENE works with zero configuration. These options are available for customization.

.codygiene.json

Place in your project root. Static and safe · no code execution.

{
  "version": 1,
  "exclude": ["**/generated/**", "**/*.min.js"],
  "rules": {
    "disable": ["CH-HEALTH-002"],
    "enable": ["CH-HEALTH-004"]
  },
  "categories": {
    "security": true,
    "performance": true,
    "codeHealth": true,
    "aiQuality": true
  },
  "reporting": {
    "includeInvestigate": false
  },
  "engine": {
    "maxFiles": 0,
    "includeGenerated": false
  }
}

Supported keys

Key	Type	Default	Description
version	1	1	Schema version. Must be 1.
exclude	string[]	[]	Glob patterns to exclude from analysis (extends defaults)
rules.enable	string[]	[]	Only enable these rule IDs (overrides disable)
rules.disable	string[]	[]	Disable these rule IDs
categories.security	boolean	true	Enable/disable security rules
categories.performance	boolean	true	Enable/disable performance rules
categories.codeHealth	boolean	true	Enable/disable code health rules
categories.aiQuality	boolean	true	Enable/disable AI quality rules
reporting.includeInvestigate	boolean	false	Include INVESTIGATE-tier findings
engine.maxFiles	number	0	Max files to parse as ASTs. 0 = no cap (analyze all). >0 = partial scan.
engine.includeGenerated	boolean	false	Analyze generated and vendored files. false = exclude them (default).

.codygieneignore

Gitignore-like exclusion patterns. One pattern per line.

node_modules
dist
build
.next
coverage
**/generated/**
*.min.js

Default exclusions

CODYGIENE automatically excludes:

• node_modules/**
• .next/**, dist/**, build/**, out/**, coverage/**
• .git/**, .codygiene/**
• Cache/output dirs (.turbo/**, .vercel/**, .output/**, .svelte-kit/**, .nuxt/**, .cache/**, .yarn/**, .pnpm-store/**)
• Vendored code (vendor/**, vendored/**, third_party/**, third-party/**, _vendor/**, bower_components/**)
• Generated code (generated/**, __generated__/**, generated-*/**, *.gen.*, *.generated.*)
• Files with generator banners (Code generated by, DO NOT EDIT, @generated, and similar headers)
• Test files (__tests__/**, __fixtures__/**, fixtures/**, *.test.*, *.spec.*)
• Generated/bundled output (*.min.js, *.bundle.js)

Test exclusion is pattern-exact: only the listed patterns are skipped. Other test-adjacent code · e2e/ and e2e-test/ directories, mocks/ directories, seed files, scripts · is analyzed normally and can produce findings.

User exclusions are applied in addition to defaults.

The number of files excluded as generated or vendored is reported in scan coverage as generatedExcludedFiles (JSON coverage.generatedExcludedFiles).

--include-generated (CLI)

Generated and vendored files are excluded from analysis by default · they are machine-produced or third-party code where findings are not actionable. To analyze them anyway:

codygiene scan --include-generated

Equivalent configuration:

{ "version": 1, "engine": { "includeGenerated": true } }

--max-files (CLI)

The CLI flag --max-files sets engine.maxFiles at runtime:

codygiene scan --max-files 500

This produces a PARTIAL scan. Scores will not be representative of the full repository.

--disable and --enable (CLI)

Disable specific rules:

codygiene scan --disable CH-HEALTH-002,CH-HEALTH-005

Enable specific rules (overrides disable, including default-disabled rules):

codygiene scan --enable CH-HEALTH-004,CH-HEALTH-008

--include-investigate (CLI)

Include INVESTIGATE-tier findings (lower confidence). By default, only SAFE and LIKELY findings are shown.

codygiene scan --include-investigate

Invalid configuration

If configuration is invalid, CODYGIENE reports the problem and the configuration file path. Ordinary config mistakes do not print raw stack traces.