{
  "_doc": "Findings the owner reviewed and accepted (false positives / deliberate). Each entry matches when ALL given fields match: rule (exact), file (regex on repo path), message (regex, case-insensitive).",
  "skip": [
    {"rule": "python:S104", "file": "^server\\.py$", "reason": "server.py binds 0.0.0.0 on purpose: Docker container reached over the LAN."},
    {"file": "^server\\.py$", "message": "0\\.0\\.0\\.0|all network interfaces", "reason": "Same: deliberate container bind (rule key differs between analyzer versions)."},
    {"rule": "python:S5443", "file": "^scripts/", "reason": "Dev-only script writes to the system tmp dir."},
    {"rule": "javascript:S2245", "file": "^static/js/", "reason": "Math.random is used for non-security UI ids."},
    {"rule": "python:S5332", "reason": "http:// URLs are LAN-internal services (no TLS inside the LAN)."},
    {"rule": "javascript:S5332", "reason": "http:// URLs are LAN-internal services (no TLS inside the LAN)."},
    {"rule": "python:S4790", "reason": "md5 is used as a cache key, not for security."}
  ]
}