shiftleft.yml

# Build rules compares PR branch check-analysis scan against 
# the main branch and break if anything new is found
source:
  branch: main
build_rules:
  - id: no-new-high-vulns-or-secrets
    finding_types:
      - vuln
      - secrets
    severity:
      - SEVERITY_HIGH_IMPACT
#  - id: build-rule-enchalada
#      - vuln
#      - secret
#      - insight
#    severity:
#      - SEVERITY_HIGH_IMPACT   # or "critical" 
#      - SEVERITY_MEDIUM_IMPACT # or "moderate"
#      - SEVERITY_LOW_IMPACT    # or "info"
#    type:
#      - Cookie Injection
#      - Deserialization
#      - Directory traversal
#      - File Write
#      - Insecure Cookie
#      - LDAP Injection
#      - Mail Injection
#      - Mass Assignment
#      - NoSQL Injection
#      - Open Redirect
#      - Remote Code Execution
#      - Sensitive Data Leak
#      - Session Injection
#      - SQL Injection
#      - TLS checks are disabled
#      - Usage of insecure API
#      - Weak Hash
#      - XML InjectionXPath Injection
#      - XPath Injection
#      - XSS
#      - XXE
#    owasp_category:
#      - a1-injection
#      - a2-broken-authentication
#      - a3-sensitive-data-exposure
#      - a4-xxe
#      - a5-broken-access-control
#      - a6-security-misconfiguration
#      - a7-cross-site-scripting
#      - a7-xss
#      - a8-deserialization