Exceptions and Risk Acceptance for Dependency Vulnerabilities

The base process, approval authorities, mandatory fields, chain of authority and lifecycle are defined in Ch. 14 - addon/12-processo-excecoes.md. This file defines only the specifics of this domain.

---

Scope

Exceptions to software composition analysis (SCA) findings - vulnerabilities in dependencies identified by a scanner, referenced by CVE or equivalent.

---

Triggers specific to this domain

An SCA exception requires that all of the following criteria be analysed and documented:

• the vulnerability has no direct impact on the application's execution context (e.g. a dependency used only in the build, not at runtime);
• there is no viable alternative version with the same expected behaviour;
• there are effective and verifiable compensating controls (e.g. sandboxing, WAF, build isolation);
• the residual risk is explicitly documented and formally accepted.

The absence of an available patch is a necessary but not sufficient condition for approval of the exception.

---

Additional mandatory fields (SCA)

Field	Mandatory	Notes
CVE / vulnerability ID	Yes
Affected component	Yes	Exact name and version (e.g. lib-legacy@1.0.4)
Context of use	Yes	runtime / build-only / test-only
Fixed version available?	Yes	If so, justification for not applying it

---

YAML template

- cve: CVE-YYYY-NNNNN
  componente: nome-do-pacote@versao
  contexto: build-only | runtime | test-only
  motivo: "Justificação técnica objectiva"
  controlo_compensatorio: "Controlo alternativo aplicado"
  aprovado_por: "nome@funcao"
  validade: "YYYY-MM-DD"
  revisao_agendada: true

Suggested location: /security/excecoes-sca.yaml in the repository, or a centralised system with traceable equivalence.

---

Cross-references

Document	Relation
02-analise-sca.md	Origin of the findings that may give rise to an exception
04-integracao-ci-cd.md	Verification of the validity of exceptions in the pipeline
08-rastreabilidade-vulnerabilidades.md	Recording of the risk acceptance decision as a final state
Ch. 14 - addon/12-processo-excecoes.md	Canonical exception management process