Feature Requests

We want to remove the specific value "For All Time" field for the "how long?" field. Ideally, being able to customize the values in the drop down would be the goal. Specifically, we want to remove For All Time, because the developers want to submit exemptions with the max time, but there are no reasons why we would allow a "for All Time" value. It doesn't appear that OPA allows us to control value or control the submission routine. This causes problems for us because it adds unnecessary delays when people submit a request for "For All Time"

Currently, when a user is added at the Account level and subsequently granted Role Binding at the Project level, the user details of the requester or approver in Security Exemption are not visible to the user. We’ve identified that users need Account-level User View access to view the Security Exemption users. To address this, we require that Security Exemption views be made compatible with Project level User View access.

In harness STO, user is not able to raise the multiple exemptions at once if there is more than one vulnerability in a pipeline.

I would like to place a bug report for hopefully then next upgrade to the Anchore Plugin. The current plugin is extremely limited, at least as far as I can tell. We would like to have the anchorectl switch -t non-os working so that CVE's shown to our deveopers in Security Tests will only show the application data CVEs that they need to be concerned with. An example from cli might be like the following: anchorectl image add rockylinux:9-ubi | anchorectl image vulnerabilities rockylinux:9-ubi -t non-os The standard command is as follows: "anchorectl image vulnerabilities myimage:latest -t non-os". So this is the image vulnerability scan which is likely different to the add command being used by the plugin. "anchorectl image add myimage" "anchorectl image vulnerabilities myimage -t non-os -o json" To be clear it needs to do both. Add the image then create a report with non-os data converted to Harness acceptable for ingest

Good Day, we are currently using Anchore via your image which uses anchorectl to generate a Security Testing report. The report is being created without issue. However, the report includes the base layer of the image as well as application data. We would like the report to only show the application data layer. For example we have things like VIM or Ubi8 os related library file CVEs. This is confusing our customers as they are only concerned with there application data and what they need to remedy within their source code. Thank You.

Needed: Ability to notify the originator of an exemption (via email) when the state of his or her exemption request changes (Denied/Approved). Nice-to-have: Additional ability to include project owners/user-subset specified by role in those notifications.

As a user of Harness Security Testing Orchestration (STO), I would like the ability to change or edit the severity of findings identified during security scans. Since the severity is not matching as per our considerations and the actual risk in our environment. Add an option to edit the severity of a finding directly from the findings dashboard. Implement role-based permissions to control who can change the severity of findings.

Burpsuite Enterprise has a facility to create custom scan configurations for scanning. Currently Harness only allows to select the default scan configurations given by Burp but there is no ability to select custom scan configurations. This would be essential as each type of application needs a different type of scan configuration in order to perform a better scan.

Anchore Enterprise in our organization uses project specific contexts to store scans and image data. To support ingestion from different contexts (using service accounts at the all-users level), we require the ability to set the X-Anchore-Account header in the HTTPS request to the API with values specifying the context within the account to apply the queries to.