Skip to main content

Vulnerability compliance

Open Settings → Vulnerability Compliance at organization scope to configure the default pipeline and policy rules related to vulnerabilities—for example severity thresholds or rules that affect whether builds or pipelines should fail (such as critical or high findings, or issues flagged by known-exploited vulnerability feeds when applicable).

Vulnerability thresholds for pipeline failures

Adjust Vulnerability thresholds (for example fail on critical/high or known exploited vulnerabilities), then Save Changes. The exact toggles and labels match the current product UI.

These settings apply to every project that uses the organization vulnerability thresholds. To notify organization users about newly found vulnerabilities, use Settings → Vulnerability Alerts instead.

Override thresholds for one project​

Organization admins can give a project its own vulnerability thresholds:

  1. Open the project and select Settings → Vuln. Compliance.
  2. Turn off Use organization vulnerability thresholds.
  3. Choose whether pipelines should fail on critical or high severity vulnerabilities and known exploited vulnerabilities.
  4. Select Save Changes.

While the override is active, later changes to the organization thresholds do not affect that project. Turn Use organization vulnerability thresholds back on to make the project follow the current organization settings again. The project-specific values are retained if you later reactivate the override.

Users who are not organization admins can view the effective thresholds but cannot change them.

How triage affects compliance checks​

Vulnerability compliance checks count findings that are not triaged, marked Exploitable, or still In triage. Findings triaged as Resolved, Not affected, or False positive do not count toward the critical/high or known-exploited vulnerability thresholds.