# Accepted CVE risk (R-VULN-08). A list; this file is the ONLY place risk can be accepted, and it reaches
# the scanner through the merge gate (a ConfigMap generated by kustomization.yaml).
#
# Each entry:
#   - id: CVE-2026-00000                 # the CVE or advisory id, exactly as the scanner reports it
#     image: registry/repository         # exact image match; omit only for a platform-wide acceptance
#     reason: not reachable, feature disabled  # mandatory, a real sentence
#     expires: 2027-02-01                # mandatory YYYY-MM-DD, at most 180 days out
#
# An accepted finding stays in the listing with its reason and expiry and stops counting toward the
# critical-fix alert. When the expiry passes it reverts to open automatically. An entry with no reason
# or no expiry, or an expiry more than 180 days out or malformed, is rejected by the merge gate
# (conformance/tests/l0-static/vuln-acceptances-schema) and ignored at runtime with the run marked
# degraded, so a finding is never hidden by a bad entry.
[]