Security exceptions
An exception lets a build pass the Build Security gate even though it has a finding the policy would block. Every exception has a reason, an expiry and an approver who is not the person who asked for it.
Two kinds of exception
| Kind | Covers | Ends |
|---|---|---|
| One build | One finding in one immutable build (one commit or one image digest) | At its expiry. The next build has new evidence, so the exception does not apply to it. |
| Issue, across builds | One security issue in one repository, in every build | At its expiry (at most 30 days), when an administrator revokes it, or as soon as the issue is fixed |
An issue exception never covers:
- a secret: rotate it and remove it from the code instead;
- a finding more severe than the issue was when the exception was requested; if the issue becomes more severe, ask again;
- the same issue in another repository.
Asking for an exception
Members can ask. Open the issue, or a finding on a build's Security tab, and choose Request exception. Loha fills in what the exception covers; you write the reason and pick the expiry, then confirm your password (step-up).
Approving
Administrators see every waiting request under Approvals, next to issue triage proposals. You approve after confirming your password (step-up), and you cannot approve your own request. Deny withdraws the request.
If exceptions are turned off for your workspace, nobody can ask for a new one, but administrators can still approve or revoke requests that are already waiting.
Why a build was blocked
With exceptions enabled, the Security tab of a build shows the gate's outcome, the rule each blocking finding met, its issue, and which exception let a finding through.
What an exception does not do
An exception changes the gate's decision only. It does not hide the finding, and it does not change the issue: an issue stays open until a scan of the tracked branch no longer finds it.
Audit
Every request, approval and revocation, including the automatic revocation when an issue is fixed, is recorded in the workspace audit log. A denial is recorded as a revocation. For issue exceptions, these are also recorded in the issue's history.