Use newline or comma separated rule IDs such as github-token, url-query-secret. Matching findings are marked exempted globally rather than removed, so they remain visible in exemption views and detailed reports.