devsecops

When using trivy image -o output.json -f json foo:latest, the output file lacks a final newline.

This is not POSIX-compliant, and causes issues when processing the file.

Can you please add the final newline?

Is your feature request related to a problem? Please describe.
It would be nice if gitleaks had a validate command that would validate examples found in the config rules. Introducing such a feature would speed up rule development and help with debugging.

Describe the solution you'd like
example entry in the rules tables
ex:

[[rules]]
id = "discord-client-secret"
des

Is your feature request related to a problem? Please describe.
I want to be able to disable a whole level of violation. For example the low error level i want to disable but still run the checks on medium, high, critical.

Describe the solution you'd like
I would like to have this possible with a simple flag in the ci to do this. To disable the violation level : low, etc. that when yo

Describe the issue
I wouldn't expect to get the alert if not defined explicitly.

Examples
https://github.com/hashicorp/terraform-provider-google/releases/tag/v4.0.0

Version (please complete the following information):

• Checkov Version 2.0.780

Found a strange behavior on netclient and found the following codes in netclient/wireguard/common.go

		if keepAliveString == "0" {
			keepAliveString = "15"
		}

Anyone knows why we are doing this?
IMO, Netclient should not decide what the value is, but follow the instructions from the server (otherwise what is the propose to having a server).

Also I found the keepalive value in

• terrascan version: 1.9.0
• terraform version: 1.0.1

Enhancement Request

Other security scanning tools (e.g. checkov and tfsec) have a --soft-fail flag or equivalent option that allows you to always exit with 0 status.

Extremely useful when running the tool without halting a pipeline for example.

I currently use a workaround, but something more concrete would be very desira

Slack us first!
Hello. I write about problem here:
https://owasp.slack.com/archives/C2P5BA8MN/p1624892081234100

Be informative
As additional into slack I find the same behaviour with Risk Accepted findings. Into Metrics I see 0 Risk Accepted findings, but I have 1 Risk Accepted finding

Bug description
No error. Metrics into product, or metrics dushboard has incorrect info

The current swagger definition is autogenerated. The automatically generated definitions rely on reflection and annotations to create the documentation. The reflection capabilities are poor at best and lead to missing API parameters. Annotations can help in some cases, but the only fix for Swagger is to create individual POJOs for every possible request. This will lead to unnecessary large number

I want to compile locally and then test it. But,

• How do I build the code?
• What environment is needed?
• What are the steps?