Exceptions in Secure Development
The base process, approval authorities, mandatory fields, chain of authority and lifecycle are defined in Ch. 14 -
addon/12-processo-excecoes.md. This file defines only the specifics of this domain.
Scope
Exceptions to practices and controls identified by SAST tools, linters or code review during development.
Triggers specific to this domain
- a SAST tool finding classified as a false positive with demonstrable technical evidence;
- a mandatory practice incompatible with a constraint of an external framework or library with no viable alternative;
- backward compatibility with a component that cannot be modified within the scope of the project;
- a temporary deviation accepted in a PR with a dated and recorded resolution plan.
Recording mechanisms in SAST tools
SAST tools allow findings to be marked directly in the report - mute, waive, false positive accepted, inline annotation. These markings are valid as a technical recording mechanism, but do not replace formal approval nor the chain of authority required by the canonical process.
Reference tools: Kiuwan, SonarQube, Xygeni, Checkmarx, Semgrep.
Traceability in the repository
In addition to the record in the tracking system, the exception must be visible in the repository:
- Versioned file:
excecoes-aprovadas.ymlwith a reference to the finding, justification, approver and validity; - Inline annotation: a
@sec:justificado: <ID-excepção>comment in the affected code; - PR / merge commit: an explicit link to the exception record in the PR body or in the commit message.
The record in the repository complements the record in the tracking system and ensures direct traceability to the code. It does not replace it.
Cross-references
| Document | Relation |
|---|---|
addon/01-boas-praticas-codigo.md | Practices that may have associated exceptions |
addon/02-linters-validacoes.md | Tools that generate findings that are candidates for exception |
addon/08-validacoes-codigo.md | Code review and blocking in PRs |
Ch. 14 - addon/12-processo-excecoes.md | Canonical exception management process |