security
4 guardrails, all at version v1.
| Guardrail | Default severity | What it checks |
|---|---|---|
security/finding-budget | warning | The number of findings at or above a severity sits within the budget the team set, so a report nobody can read does not pass for a clean one. |
security/fixable-vulnerabilities | warning | Every finding the scanner reported a fixed version for is taken, so the ones that cost an upgrade rather than a redesign are not the ones left open. |
security/no-high-findings | error | Every finding the scanner reported sits below the severity the team gates on. |
security/scan-results-present | error | A scanner ran and left a report the build can be judged on, rather than the build reporting nothing at all. |
Shared collectors
Every security guardrail is handed the facts these collectors gather, and each one may ask for more of its own.
| Collector | Gathers |
|---|---|
scan | Findings from whatever scanner the build already ran, read from the report it left behind and normalized into one shape, whether the tool was a SAST, an SCA, a secret detector or an infrastructure scanner. |
Every guardrail in this category is configured the same way, in the guardrails.checks array of buildnote.json. See Configuring guardrails for every option, and Guardrails to search the whole library.