Inspector Code Security is disappointing

Is there a way to tell it to ignore certain findings like a comment in the code? Most code scanners have something like this to manage false positives

Workarounds for false positives: Use suppression rules in the Inspector console (filter by Vulnerability ID, severity, or resource tag) to archive findings you don't intend to act on. For the immediate issue, open an AWS Support case with the specific finding JSON — the team can confirm false positives and escalate to the service team if needed.

For deeper coverage: AWS Security Agent takes a context-aware approach — it reviews design documents, analyzes pull requests against custom security policies, and performs on-demand penetration testing by understanding how your application actually works. It validates findings through exploitation before reporting, which significantly reduces false positives.

Inspector and AWS Security Agent are complementary — Inspector for continuous CVE detection at scale, Security Agent for deep application-level analysis. For a full SDLC walkthrough: Shift Left or Fall Behind: How AWS Security Agent Embeds Security into Every Phase of Your SDLC

I understand your frustration with Amazon Inspector Code Security's performance on your React.js project.

Amazon Inspector Code Security is designed to scan first-party application source code, third-party dependencies, and Infrastructure as Code for vulnerabilities. It includes Static Application Security Testing (SAST), Software Composition Analysis (SCA), and Infrastructure as Code (IaC) scanning capabilities.

For SAST specifically, Amazon Inspector analyzes source code to identify potential security vulnerabilities such as hardcoded secrets, cross-site scripting, or injection attacks across various programming languages including JavaScript, Python, C#, and Bash shell scripts.

The issues you're experiencing with false positives or missed vulnerabilities in your React.js project could be related to how the scanner interprets dependencies or code patterns. Similar issues have been reported with Amazon Inspector's ECR scanning, where it was finding vulnerabilities in Java packages referenced in pom.xml files even when those dependencies had scopes like "provided" that indicated they weren't actually included in the final artifact. AWS has made updates to address some of these false positive issues in their scanning engine.

If you're finding the results unhelpful or inaccurate, I'd recommend reaching out to AWS Support to report these specific issues with your React.js project. They may be able to provide guidance or make improvements to the scanning engine to better handle React.js projects and modern JavaScript frameworks.
Sources
Amazon Inspector Code Security - Amazon Inspector
Inspector: false positives in ECR from pom.xml files | AWS re:Post
Beyond compute: Shifting vulnerability detection left with Amazon Inspector code security capabilities | AWS Security Blog