Question

A financial services organization uses a code scanning severity ruleset that blocks merges when a high-severity alert exists. A team lead requests a permanent exception for one repository, arguing that a specific alert is a false positive tied to a legacy internal library. As the security manager responsible for governance, you want to grant relief without permanently weakening the control or losing visibility. Which approach best balances developer velocity with ongoing governance?

Accepted Answer

Grant a time-bound, documented exception (such as a scoped ruleset exemption or a temporary bypass entry on the merge-protection ruleset) that requires re-evaluation at expiry, keeping the alert visible and auditable

Answer

Permanently remove the repository from the ruleset scope so the merge is never blocked again

Answer

Lower the security-severity threshold of the ruleset organization-wide so high-severity alerts no longer block merges

Answer

Delete the code scanning alert from the repository so it no longer triggers the merge block