Optional Socket GitHub App configuration file

You can optionally configure the Socket GitHub app by adding a socket.yml file to the root of your repo.

  - ignored-folder
  - foo/bar/package.json

  unresolvedRequire: false

# enable/disable the GitHub app entirely
enabled: true

# enable/disable GitHub app pull request alert checks
pullRequestAlertsEnabled: true

# enable/disable Github app project report checks
projectReportsEnabled: true

# beta opt in field
beta: false



The socket.yml file is only supported in the root of your repo and with no other file extensions than the .yml one.


All fields listed here are optional.


The ignore key is an array of strings that are used to ignore folders or files.

The individual strings in the ignore array work like .gitignore patterns.

The following patterns are always included in the ignore array by default:

  • node_modules
  • .yarn


issues is a map of issue names from Socket's Issues page that allows you to enable or disable issue alerts in your pull requests. Issues are identified by the url slug of the corresponding issue page. The default issues map looks like this:

  didYouMean: true
  installScripts: true
  telemetry: true
  troll: true
  malware: true
  hasNativeCode: true
  binScriptConfusion: true
  shellScriptOverride: true
  gitDependency: true
  httpDependency: true
  invalidPackageJSON: true
  unresolvedRequire: true

You can disable issue by setting it's value to false. You can also enable alerts for any other issue that isn't enabled by default by setting the issue slug value to true in the issues map.


Default: true.

If you want the Socket GitHub app to never run on a repo and do not have org permissions to disable GitHub access to that repo, you can add a socket.yml file to your repo and set enabled to false.

Setting enabled to false will override other settings in the socket.yml associated with the GitHub app.


Default: true.

The pullRequestAlertsEnabled field can be used to individually disable pull request alerts check runs and pull request comments generated by the GitHub app.

The enabled field must be set to true for this field to have any effect.


Default: true.

The projectReportsEnabled field can be used to individually disable project reports check runs for commits from being generated.

The enabled field must be set to true for this field to have any effect.


Default: false.

To opt in to new features before we roll them out to everyone, set this field to true. Please note that beta features may be unstable!

What’s Next

Learn how to ignore specific pull request alerts in Socket for GitHub: