Turn on your linter's report for unused suppressions, so any disable comment that no longer suppresses a real finding is flagged. In ESLint this is the reportUnusedDisableDirectives setting, which defaults to warn. Raise it to error once the backlog is clear, and old exceptions stop piling up.
What an unused suppression is
A suppression comment tells a tool to ignore a rule on a line or in a block. Over time the code under the comment changes. The unsafe call is removed, or the rule is rewritten, yet the comment stays. It now suppresses nothing, but it will also silently suppress any new problem that appears at that spot. That is the risk: a hidden exemption waiting for the next bug.
How ESLint handles it
The ESLint documentation describes a setting that reports unused disable directives, meaning those that disable rules which would not report on the disabled line. It is set through linterOptions in the configuration file, and it defaults to warn. A matching command line option exists, with a companion option for setting its severity.
// eslint.config.js
import { defineConfig } from "eslint/config";
export default defineConfig([
{
linterOptions: {
reportUnusedDisableDirectives: "error"
}
}
]);
ESLint bulk suppressions behave similarly: when a recorded violation is fixed, the run reports that suppressions are left that no longer occur, and a prune flag removes them.
Steps
- Enable the report at warn level and count the results.
- Remove unused comments in one cleanup pull request, with a clear title so it is easy to review.
- Raise the setting to error so new stale comments fail the build.
- Do the same for any central ignore or baseline file.
- After a rule change, expect a wave of newly unused comments, and clean them up in the same release.
Why a rule change creates them
If you narrow a rule to fix a false positive, every suppression added for that false positive becomes unused. This is a good sign: the loop worked. Cleaning those comments up is the last step of the fix.
Related habits
| Habit | Effect |
|---|---|
| Require a reason in each suppression | Reviewers can judge it |
| Set an expiry or review date | Exceptions return for a decision |
| Report unused ones | Dead exemptions are removed |
| Count suppressions per rule | Reveals noisy rules |
Reasons and expiry dates are worth enforcing alongside the unused report.
What not to do
- Do not remove a suppression without checking that the finding is truly gone. Some tools report a comment as unused when a different config applies.
- Do not auto delete all unused comments in a huge unreviewed change.
- Do not leave the setting at warn forever, since warnings are routinely ignored.
Quick check
Is an unused suppression a security issue?
It can become one. It is an exemption with no current purpose, and it will hide a future finding on that line.
What is the default in ESLint?
According to its configuration documentation, reportUnusedDisableDirectives defaults to warn.
Safeguard's scanning covers dependencies and SBOMs, and its reachability analysis helps show which findings your code can actually call. You can run a free scan on a repository.
Sources
Last reviewed: 19 October 2026.
