pub struct DetectionExclusionConfig {
pub excluded_detection_headers: Vec<String>,
pub excluded_semantic_detection_headers: Vec<String>,
pub excluded_detection_params: Vec<String>,
pub excluded_detection_body_fields: Vec<String>,
pub enabled_detection_categories: Option<Vec<String>>,
pub detection_scan_body: Option<bool>,
pub max_scan_seconds: Option<f64>,
}Expand description
The global config’s detection-exclusion surface.
The reference SecurityConfig fields of the same names. The category
set is None when nothing is configured (every category scans); the
scan-body flag is None for the reference default (true).
Fields§
§excluded_detection_headers: Vec<String>excluded_detection_headers (merged with the defaults, never a
replacement).
excluded_semantic_detection_headers: Vec<String>excluded_semantic_detection_headers (opt-in, default empty):
header names whose values skip the semantic analyzer only, matched
case-insensitively. Regex category scanning is unchanged.
excluded_detection_params: Vec<String>excluded_detection_params.
excluded_detection_body_fields: Vec<String>excluded_detection_body_fields.
enabled_detection_categories: Option<Vec<String>>enabled_detection_categories: None scans every category.
detection_scan_body: Option<bool>detection_scan_body: None is the reference default (true).
max_scan_seconds: Option<f64>detection_max_scan_seconds (valid 0.1 to 60): the per-request cap on
the summed regex scan CPU time; None is the reference default
(DEFAULT_MAX_SCAN_SECONDS, 10.0). See crate::scan_budget.