jakman85andClaude Opus 5.5
b85d1e3ed7
Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>), five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with mutation self-tests. src/ and the bot workflow are integrated separately. Co-Authored-By: Claude Opus 5.5 <[email protected]>
16 lines
1.0 KiB
YAML
16 lines
1.0 KiB
YAML
# Accepted CVE risk (R-VULN-08). A list; this file is the ONLY place risk can be accepted, and it reaches
|
|
# the scanner through the merge gate (a ConfigMap generated by kustomization.yaml).
|
|
#
|
|
# Each entry:
|
|
# - id: CVE-2026-00000 # the CVE or advisory id, exactly as the scanner reports it
|
|
# image: registry/repository # exact image match; omit only for a platform-wide acceptance
|
|
# reason: not reachable, feature disabled # mandatory, a real sentence
|
|
# expires: 2027-02-01 # mandatory YYYY-MM-DD, at most 180 days out
|
|
#
|
|
# An accepted finding stays in the listing with its reason and expiry and stops counting toward the
|
|
# critical-fix alert. When the expiry passes it reverts to open automatically. An entry with no reason
|
|
# or no expiry, or an expiry more than 180 days out or malformed, is rejected by the merge gate
|
|
# (conformance/tests/l0-static/vuln-acceptances-schema) and ignored at runtime with the run marked
|
|
# degraded, so a finding is never hidden by a bad entry.
|
|
[]
|