Changes for content/handbook/security/product-security/vulnerability-management/customer-scan-review-requests.md: 12 added lines, 0 removed lines.
Original line number
Diff line number
Diff line
@@ -26,6 +26,18 @@ We accept results from any scanner, though the annotations will be based on the
- Container(s) Name and Tag
- Scanner Used
#### Runtime lockfile findings are out of scope
Package manager lockfiles, such as `Gemfile.lock`, may not reflect the real state of a running system. Lockfiles installed on the system could be artifacts of the install process (possibly even leftover from past installs/upgrades) and are not generally representative of what's actually running.
A dependency listed in a lockfile may not be installed in a given environment (e.g., dev-only dependencies excluded from production builds), may be overridden by a resolution strategy or dynamic import, or may have been installed at a different version than what the lockfile specifies due to manual intervention or tooling behavior.
We therefore consider runtime/workload lockfile scan findings to be non-actionable false positives and out of scope for annotations.
Some scanners like [Wiz](https://docs.wiz.io/docs/vulnerability-scanner-settings#configure-code-library-scanning) can be configured to exclude lockfiles automatically from runtime scans.
If runtime scan results are provided with lockfile findings, these lockfile findings may be excluded from annotations.
