ukmesh/docs/security-waivers.md

Security waiver policy

Production images may not be released with an unwaived critical vulnerability. The release workflow scans the exact pushed digest and reads .trivyignore.yaml; a tag or a locally rebuilt image is never substituted for that digest.

An exception is allowed only when all of the following are true:

• the vulnerability ID and affected path or package are specific;
• the statement records the applicability analysis, compensating control, owner=<team-or-person>, and reviewed=YYYY-MM-DD;
• expired_at is no more than 30 days after the review date;
• a security reviewer approved the change through normal code review; and
• a follow-up issue is linked in the statement.

Example:

vulnerabilities:
  - id: CVE-2099-0001
    paths:
      - usr/lib/example.so
    statement: >-
      Not reachable in this image; issue=SEC-123; owner=platform;
      reviewed=2099-01-02
    expired_at: 2099-02-01

node scripts/check-trivy-waivers.mjs validates uniqueness, ownership, review date, expiry, and the maximum lifetime. Remove the entry as soon as a fixed base image or dependency is available. Waivers must never suppress an entire scanner, severity, or image.