Configuration

Configure scan rules, model provider translation, and the inputs used by a complete lifecycle run.

The config file

secureai scan reads secureai.config.yaml from the working directory. Point it elsewhere with --config. Every field is optional; with no file at all, all nine rules run and nothing gates.

secureai.config.yaml

rules:
  # Run only these rule IDs (omit 'enabled' to run all rules).
  # enabled: [R-01, R-02, R-03, R-06]
  # Turn specific rules off.
  disabled: []

# Replace a rule's default severity on every finding it raises.
severity_overrides:
  R-08: medium   # treat missing context boundaries as Medium instead of Low

# Default severity gate for the exit code; --fail-on overrides this.
fail_on: high

Model provider config

secureai proxy reads secureai.provider.yaml. The provider owner must supply the endpoint, model, and authentication environment variable. Use a built-in provider type or a custom JSON request template and response path.

secureai.provider.yaml

version: 1
listen: 127.0.0.1:8090
provider:
  type: gemini
  endpoint: https://generativelanguage.googleapis.com/v1beta/models/my-model:generateContent
  model: my-model
  api_key_env: GEMINI_API_KEY

Secrets are not valid config values. Store them in the named environment variable. See Model proxy for presets, custom mappings, and security limits.

Lifecycle run config

secureai run reads secureai.run.yaml. It contains one BUILD target, one TEST target, and lists of VALIDATE and RUNTIME checks. This file can be committed because provider secrets are referenced by environment variable name.

Terminal

secureai run --config secureai.run.yaml

See Run all phases for the complete schema and exit behaviour.

Selecting rules

Field	Type	Effect
`rules.enabled`	list of rule IDs	Allow-list. Only these run. Omit the field to run everything.
`rules.disabled`	list of rule IDs	Deny-list. Everything runs except these.

--rules R-01,R-02 on the command line overrides both, which is handy for a one-off investigation without touching the committed file.

Prefer disabling to loosening

If one rule produces noise in your codebase, disable that rule and keep the gate tight. Dropping fail_on from high to critical to silence one rule also silences every other High finding you have not seen yet.

Severity overrides

Each rule ships with a default severity. Override it when your context differs. An internal tool with no untrusted input is not the same risk as a public chat surface.

secureai.config.yaml

severity_overrides:
  R-08: medium    # missing context boundaries - raise it, we handle untrusted input
  R-07: low       # unrestricted output format - this service returns plain text only

Valid values: informational, low, medium, high, critical. The override applies to every finding that rule raises, and the report shows the effective severity.

The gate

fail_on sets the default exit-code gate. A finding at or above that severity makes scan exit 1.

Setting	Exits 1 when
`fail_on: critical`	Any Critical finding exists.
`fail_on: high`	Any Critical or High finding exists.
`fail_on: medium`	Any Critical, High, or Medium finding exists.
Omitted	Never. The scan reports but does not gate.

--fail-onoverrides the file, so CI can enforce a stricter bar than a developer's local run.

Precedence

Highest wins:

Command-line flags: --rules, --fail-on
The config file: secureai.config.yaml or --config
Built-in defaults: all rules, no gate

Environment variables

Variable	Purpose
`SECUREAI_SERVER`	Control-plane URL for upload and payload fetch. Overridden by `--server`.
`SECUREAI_TOKEN`	CLI token for non-interactive use. Takes precedence over the stored session. See CI integration.

Where credentials live

~/.secureai/credentials.json, written with owner-only permissions by secureai login. It holds the server, session token, your email, name, and role. Do not commit it, and do not copy it between machines. Issue a scoped token instead.

Monorepos

Keep a config file per component and scan them separately, so a permissive setting in one service cannot weaken another.

Terminal

secureai scan ./services/support-bot/prompts \
  --config ./services/support-bot/secureai.config.yaml --fail-on high

secureai scan ./services/payments-agent/prompts \
  --config ./services/payments-agent/secureai.config.yaml --fail-on critical