**In Scope:** * Support reachability metadata on tracked branches, presenting the data in the vulnerability report, vulnerability details, and pipeline security tab for SCA vulnerabilities on non default branches. * Support autoremediation policies for vulnerabilities on non default branches. * Support auto dismiss policies for vulnerabilities on non default branches. * For all policies, include any relevant policy affecting the vulnerability in vulnerability details on vulnerabilities on non default branches. * Support FP analysis on tracked branches, presenting the data in the vulnerability report and vulnerability details page and pipeline security tab for SAST and Secrets on non default branches * Support ~~SDLC agent~~ Vulnerability Context Flow context collection on non default branch vulnerabilities * Support SAST and SCA VR executions on vulnerabilities found on tracked non default branches. * _Addition 7/29:_ For all agentic flows, this would include bulk executions and single shot executions, as well as the automated flow execution looking at the non default branches. * Addition 8/4 - if a project is configured for automation, then all tracked branches on that project should execute the flow according to its fixed parameters (IE - SAST VR runs on net new criticals and highs) until these [requirements](https://gitlab.com/groups/gitlab-org/-/work_items/21977#note_3533225781) are complete. **Out of Scope:** * Support for these behaviors on untracked developer branches in the merge request (see [**Security Data in Merge Request Iteration 5: FP Detection & VR Support**](https://gitlab.com/groups/gitlab-org/-/work_items/21634#top)**)** **Designs:** _TBD_ **Dependencies:** _TBD_ --- ## Work Breakdown (Iteration 4 / GA) This epic builds on the existing VAC infrastructure from &3430 (tracked-context model, ingestion on non-default branches, finding:left_right_arrow:context association — all already merged). The remaining work makes the _advanced_ security capabilities properly branch-contextualized rather than project-global. | Feature | Issue | Owner | |---------|-------|-------| | Reachability — context-aware SBOM query layer | #602156 | Composition Analysis | | Reachability — `Vulnerability#reachability` + GraphQL consumer | #602157 | Sec-Infra (supporting) | | Reachability — backfill `vulnerability_occurrence_id` BBM (prereq) | #602158 | Composition Analysis | | VR auto-remediation MR targeting (SCA/Bundler) | #602159 | Composition Analysis | | Auto-dismiss / auto-resolve context-awareness | #589786 | Sec-Infra | | FP detection per tracked context (verify + guard) | #602160 | Sec AI | | End-to-end validation matrix | #602161 | Sec-Infra | **Sequencing:** #602158 (backfill) unblocks #602156 → #602157. #602157, #589786, #602159, #602160 then run largely in parallel. #602161 validates all. **~~SDLC agent context~~ Vulnerability Context Flow** **collection** (original scope bullet) is tracked separately in &21576 (GA: tracked-branch SDLC support) and is **out of scope** for this epic. Related: &21005, &20894.