Feature Requests

Coming from a customer request, they would like the ability to perform similar policy-based STO enforcement on their NexusIQ scans. They would also like a template-step experience for it as well. https://developer.harness.io/docs/security-testing-orchestration/sto-techref-category/sonarqube-sonar-scanner-reference/#view-sonarqube-code-coverage-results https://help.sonatype.com/en/policy-violation-rest-api.html

We would want to enforce Secrets prevention scanning of IaC code with Gitleaks before deployment in an IACM stage, thanks.

Currently the only results you will see for STO in the security results page will be for the latest execution of the pipeline. That execution may not be the complete pipeline. In the case where the user has had a failure and resumes the execution from last successful stage, any scan results from that previous execution will not be displayed in the security tests page. User will need to iterate through the execution history to find the various scan results.

Many teams use not only CI when deploying infrastructure, and we need to enable (and enforce via OPA) teams to scan their IAC before deploying. Currently there is no way to perform Wiz Native scanning or using Custom Scan Ingestion steps (two different solutions) within CD or Custom Stages. We need teams to be able to view their vulnerabilities regardless of the stage they are deploying.