> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safedep.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Trust a Package After a False Positive

> Create a trust entry in the cloud policy to waive a malware, cooldown or vulnerability verdict for one package, with a reason and an expiry.

Use a trust entry when your team reviewed a package and decided that a verdict is wrong for your tenant. A trust entry waives the verdicts of its scopes for one package until it expires. It replaces [Malicious Package Exclusions](https://docs.safedep.io/governance/cloud/package-exclusions.md).

> [!NOTE]
>
> This guide needs the SafeDep Cloud Team or Enterprise plan and the Admin role. See [pricing](https://safedep.io/pricing).

## Create the trust entry

```bash theme={null}
safedep policy rule create --trust pkg:pypi/foo@1.0.3 --scope malware \
  --reason "False positive, S-88" --expires 30d --requested-by data-eng
```

* The selector names one package. Add a version in the PURL, or a range with `--vers`, to trust only some versions. A trust entry cannot use a prefix.
* `--scope` names the verdicts to waive. Give it more than once, or use `all`. See [Choose the scope](#choose-the-scope).
* `--expires` is required. It takes a duration, as `30d`, or a date, as `2027-01-26`. The expiry is at most 90 days from now.
* `--reason` is required.

The command warns that the rule loosens the policy, creates the rule and publishes a new policy revision. Every Owner and Admin of the tenant gets an email about it.

## Choose the scope

| Scope | Use it when | Where it applies |
| - | - | - |
| `malware` | SafeDep marks the package as malicious or suspicious, and you reviewed it | PMG and the pull request check |
| `cooldown` | You must install a new version before the dependency cooldown ends, such as your own SDK | PMG |
| `vulnerability` | A pull request check fails on a vulnerability that you accept for this package | The pull request check |

Choose the narrowest scope. `--scope all` expands to the scopes that exist now. A scope that a later release adds does not apply to this rule.

A trust entry never waives a verdict of **verified** malware, whatever its scope. A trust entry also never skips the malware analysis. If a block entry selects the same package, the block entry wins.

## Extend or end the trust

To extend the trust entry, give a new expiry. A later expiry loosens the policy:

```bash theme={null}
safedep policy rule update r_a41b7c9xkd --expires 90d --reason "Reviewed again for Q1"
```

To list the trust entries that expire soon:

```bash theme={null}
safedep policy rule list --effect trust --expiring 7d
```

To end the trust now, delete the rule. The delete tightens the policy:

```bash theme={null}
safedep policy rule delete r_a41b7c9xkd --reason "Upstream fixed the false positive"
```

An expired trust entry no longer applies. PMG drops it at its expiry also when the endpoint is offline.

## Move from Malicious Package Exclusions

Trust entries with the scope `malware` replace Malicious Package Exclusions. SafeDep Cloud does not copy exclusions into the cloud policy. For each exclusion that you still need, create a trust entry:

| Exclusion field | Trust entry |
| - | - |
| Ecosystem, package name | The PURL, as `pkg:npm/name` |
| Version | A version in the PURL. For the version `0` (all versions), give no version. |
| Reason | `--reason` |
| Expires At | `--expires`. A trust entry needs an expiry of at most 90 days. |

PMG with `cloud.policy` on ignores the exclusions and applies only the trust entries.

## Next steps

> [card] [Package Rules](https://docs.safedep.io/concepts/package-rules.md)
>
> Trust scopes and the verified malware guard.

> [card] [Explain a Decision](https://docs.safedep.io/governance/cloud/policy/explain-a-decision.md)
>
> List the installs that a trust entry allowed.

> [card] [Malicious Package](https://docs.safedep.io/concepts/malicious-package.md)
>
> How SafeDep classifies a package as malicious.

> [card] [Command Reference](https://github.com/safedep/cli/tree/main/docs/cmd)
>
> Every flag of `safedep policy rule`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.