Skip to main content

Vulnerability exceptions

Kwatch blocks releases for unresolved high or critical vulnerabilities reported by Go dependency or container image scans. An exception is allowed only when the finding is not exploitable in the supported deployment, a compensating control reduces the risk, or an upstream fix is not yet available.

Required record​

Every exception must be recorded in a reviewed issue or security advisory before the release. Record:

  • vulnerability identifier and affected dependency or image layer;
  • severity and scanner report;
  • affected release and first release where the exception applies;
  • owner responsible for remediation;
  • technical reason and compensating controls;
  • explicit expiration date no more than 90 days away;
  • tracking issue and planned remediation version.

Exceptions are temporary risk decisions, not permanent scanner suppressions. The release owner reviews every active exception for each release and removes it when the dependency or base image is fixed. An expired exception fails release review.

Do not put credentials, exploit payloads, or sensitive cluster information in a public issue. Use GitHub private vulnerability reporting when disclosure could expose users before a fix is available. See the security policy for the reporting and supported-version process.