Skip to main content
When you run octopoda scan, the CLI packs your project into an archive and uploads it. It leaves out secrets and generated files automatically, and you can exclude more with a .octopodaignore file. Scans of a GitHub repository started from the web app or a pull request read the repository directly and are not affected by this page.

​
What the CLI includes

  • In a git repository: the files git tracks, plus new files that .gitignore does not ignore.
  • Elsewhere: every file in the folder, except dependency and build folders such as node_modules, .next, dist, build, .venv, __pycache__, target and .git.

​
What the CLI always leaves out

  • .env and .env.* files, except templates ending in .example, .sample or .template.
  • Private keys and certificates: files ending in .pem, .key, .p12 or .pfx, and id_rsa or id_ed25519.
  • Any single file larger than 5 MB.
The CLI tells you how many files it left out:
The CLI cannot recognize every secret. Keep API keys and passwords out of your source files, and use test data instead of real customer data in the repository.

​
Exclude more files

Create a .octopodaignore file in the folder you scan. Write one pattern per line. Lines starting with # are comments.
.octopodaignore
A pattern matches a file if it matches the file’s path from the project folder, any folder in that path, or the file’s name. Patterns use * and ? wildcards, and a leading or trailing / is ignored.

​
Size limit

A project can be at most 200 MB after these exclusions. If yours is larger, the CLI stops before uploading:
Add patterns for generated files, build output or large fixtures, and run the scan again.