Governed ignores with Ignore Approval Workflow (IAW)

Until now, a developer could suppress a Snyk Code finding on their own — directly in the Web UI or IDE — with no review step.

Suppression happened silently and unilaterally, leaving security teams without a gate on what got ignored.

Ignore Approval Workflow changes that.

An ignore is no longer applied automatically — it becomes a request that only takes effect after a reviewer approves it. Developers submit ignores from where they work; a reviewer approves or rejects from the web; both sides are notified of the outcome. Suppression moves from an ungoverned action to a reviewed, auditable one.

What you can do

• Submit ignore requests from the CLI, IDE, or API — a reason is required, and the ignore is created as Pending rather than applied.

• Review from the web — reviewers with the review permission approve or reject on the Ignore Requests page.

• Auto-approve your own — reviewers can bypass triage for ignores they create themselves.

• Stay notified — reviewers are emailed on new requests and requesters on the outcome.

• Control access with roles — read / create / edit / review / delete permissions; by default Collaborators request and Admins review, with custom roles supported.

• Audit everything — export ignore-request data via the audit-logs API.