security-gates

Security Gates

Quality gate definitions, threshold configuration, and the decision framework for when to break the build versus when to warn.

Knowledge Base

What is a Security Gate

A security gate is a decision point in a CI/CD pipeline where security findings are evaluated against defined thresholds to determine if the build should proceed, warn, or fail. Gates are the enforcement mechanism that turns security scanning from informational noise into actionable workflow.

Gate Types

Hard Gate (Block): The pipeline fails. The PR cannot be merged, the artifact cannot be deployed. Reserved for findings that represent unacceptable risk.

Soft Gate (Warn): The pipeline succeeds, but findings are surfaced prominently -- in PR comments, dashboard alerts, or Slack notifications. Used for findings that need attention but should not block velocity.

Log Gate (Track): Findings are recorded for metrics and trending but not surfaced to developers in real time. Used for low-severity findings and baseline tracking.

The Gate Paradox

Too strict: Developers route around security (force-merge, disable checks, move to unprotected branches). Too loose: Vulnerabilities ship to production. The goal is a gate configuration that developers perceive as fair, consistent, and actionable.

Patterns

Pattern 1: Severity-Based Gate Matrix

The most common approach. Gate decisions based on finding severity.

# gate-config.yml -- conceptual, implemented per-tool
gates:
  sast:
    block:
      - severity: critical
        confidence: high
      - severity: high
        confidence: high
        new_only: true  # Only block on NEW high findings
    warn:
      - severity: high
        confidence: medium
      - severity: medium
    log:
      - severity: low
      - severity: info

  sca:
    block:
      - severity: critical
        fix_available: true    # Only block if there's a fix
      - cisa_kev: true         # Block any actively exploited vuln
    warn:
      - severity: critical
        fix_available: false   # No fix yet -- track closely
      - severity: high
    log:
      - severity: medium
      - severity: low

  secrets:
    block:
      - any: true              # Any secret detection blocks
    exceptions:
      - pattern: "example_*"   # Test/example values allowed
      - path: "test/**"        # Test fixtures may contain fake secrets

  container:
    block:
      - severity: critical
        fix_available: true
    warn:
      - severity: critical
        fix_available: false
      - severity: high
    log:
      - severity: medium
      - severity: low

  iac:
    block:
      - severity: critical     # Public buckets, unencrypted data stores
    warn:
      - severity: high
    log:
      - severity: medium
      - severity: low