Skip to main content

Issues

Issues list

Every issue is raised by a control, and has a unique ISSUE-XXXX identifier. The Controls page holds the full table of controls.

Click any issue for its full description, impact, before/after configuration examples, and remediation steps. Pick a provider tab below, or All for every issue code once, whichever provider raises it.

CI/CD provider

CI/CD Container Images

ISSUE-101Untrusted image source

ISSUE-102Forbidden container image tag

ISSUE-103Container image is not pinned by digest

CI/CD Variables

ISSUE-201Unprotected variable

ISSUE-202Unmasked variable

ISSUE-203Pipeline enables CI debug trace

ISSUE-204Unsafe variable expansion

ISSUE-205Job variable overrides controlled variable

Pipeline Composition

ISSUE-401Hardcoded job

ISSUE-402Include ref collides with both a tag and a branch upstream

ISSUE-403Outdated template

ISSUE-404Forbidden include version

ISSUE-405Missing required template

ISSUE-406Forbidden override of required template

ISSUE-408Missing required component

ISSUE-409Forbidden override of required component

ISSUE-410Security job weakened

ISSUE-411Unverified script execution

ISSUE-412Docker-in-Docker service detected

ISSUE-413Docker-in-Docker with insecure daemon configuration

Access and Authorization

ISSUE-501Branch protection missing

ISSUE-502Merge request approval rule is below the minimum level of approvals required

ISSUE-503Merge request approval settings are not compliant

ISSUE-504No merge request approval rule covering all protected branches

ISSUE-505Branch protection configuration not compliant

ISSUE-506Merge request settings are not compliant

Security Source

ISSUE-601Missing security policy source on project

Issues status

In the Plumber Platform, an issue carries one of four statuses:

Detected: the default state of a newly discovered issue.
In progress: somebody started working on the fix.
Dismissed: somebody assessed the issue and set it aside. A dismissed issue stays ignored when a later analysis detects it again.
Fixed: the issue is fixed, or no longer detected. Reintroduced and detected again, it goes back to Detected.

The usual lifecycle: