Scanner findings sit within the budget
security/finding-budget@v1
The number of findings at or above a severity sits within the budget the team set, so a report nobody can read does not pass for a clean one.
| Id | security/finding-budget |
| Version | v1 |
| Category | security |
| Default severity | warning |
| Interpreter | python3 |
| Timeout | 30 seconds |
| Violations tolerated | 0 |
| Collects | scan |
Collectors
This guardrail gathers nothing itself. It depends on the collectors below, which the CLI runs once per build before any check, and reads what they found out of GUARDRAIL_FACTS. A collector that collects nothing skips this guardrail rather than failing it.
| Collector | Gathers | Inputs it is given |
|---|---|---|
scan | Findings from whatever scanner the build already ran, read from the report it left behind and normalized into one shape, whether the tool was a SAST, an SCA, a secret detector or an infrastructure scanner. | none |
The inputs above are this guardrail's own, passed straight through. Configuring one in buildnote.json changes what is collected, and two guardrails configured the same way share the one collection.
Configuration
{
"guardrails": {
"failOn": "error",
"comment": true,
"checks": [
{
"use": "security/finding-budget@v1",
"severity": "warning",
"with": {
"severity": "medium",
"budget": "25",
"kinds": "sast,sca,iac,container,secret"
},
"exemptions": []
}
]
}
}Inputs
| Input | Description | Default | Environment variable |
|---|---|---|---|
severity | Lowest severity that counts against the budget. One of critical, high, medium, low, info. | medium | GUARDRAIL_INPUT_SEVERITY |
budget | Most findings at or above that severity the build may carry. | 25 | GUARDRAIL_INPUT_BUDGET |
kinds | Comma separated kinds of finding that are counted, as the collector normalises them: sast, sca, secret, iac, container, unknown. | sast,sca,iac,container,secret | GUARDRAIL_INPUT_KINDS |
How to fix
Work the count down, or move the budget deliberately and record why. Lowering the number is the point: a budget that is raised whenever it is breached measures nothing.
security/no-high-findings is the gate on what may never ship. This is the one on what has accumulated below it, which is where a scanner report goes when nobody is holding a number: five hundred medium findings is not a list anybody triages, and the one that matters is somewhere in it.
More in security
security/fixable-vulnerabilities. Every finding the scanner reported a fixed version for is taken, so the ones that cost an upgrade rather than a redesign are not the ones left open.security/no-high-findings. Every finding the scanner reported sits below the severity the team gates on.security/scan-results-present. A scanner ran and left a report the build can be judged on, rather than the build reporting nothing at all.