Developers request exceptions to policy and the security team decides
A waiver workflow for blocked packages. Developers request an exception from the blocked install, and one team, such as security, approves or denies it. Every request and decision is recorded in the audit log.
How exception requests work
1Choose who decides
Give one team, such as security, permission to add exceptions on the firewall. Turn on exception requests and name that team to be emailed about each new request.
2Request from the blocked install
The developer opens the blocked entry in the log and requests an exception. The rule, package and version are filled in, and they add a reason, an expiry and a justification.
3Approve or deny
The reviewer can narrow the version or shorten the expiry before approving, and the exception applies within seconds. A denial needs a comment. Either way, the developer gets an email with the decision.
What every exception keeps
- Every other rule still applies
- An exception lets the packages it covers past the rule it names. The malware rule, the release delay and any rule you add later still check them.
- An end date
- When the expiry passes, the block returns. Nobody has to remember to remove the exception.
- Who asked and who decided
- An approved request stays linked to the exception it added, with the justification and the reviewer's comment.
- A record, and events for your tools
- Every request and decision is in the audit log. A webhook event for each status change can post to chat or open a ticket.
{ "id": "npm-team-a", "parentId": "npm-baseline", "exceptionRequests": { "enabled": true, "teamId": "security" }, "permissions": { "everybody": ["fw:access", "fw:clone", "fw:read"], "security": ["fw:read", "fw:update:exception"] }}Questions
Who can approve a request?
Anyone with permission to add exceptions on the firewall. For a rule inherited from a baseline, the reviewer also needs that permission on the baseline.
Is an exception the same as a waiver?
Yes. Other tools call it a waiver. In Dependency Firewall it is an exception, and asking for one is an exception request.
Can a pipeline request an exception?
No. A request needs a person to tell about the decision, so it comes from the dashboard or a personal access token. Service access tokens cannot request.
What if several developers ask for the same exception?
Approving one request approves the other pending requests for the same rule and package with it.
Can requests reach our chat or ticket system?
Yes. Subscribe a webhook to the exception request events. There is one each for created, approved, denied and withdrawn, and each carries the full request.
All features
- Hold new releases until they have cooled offRelease delay
- Block malicious packagesMalware blocking
- Set the rules centrally for every team and agentCentralize firewall rules
- Developers request exceptions to policy and the security team decidesException workflow, this page
- Block versions with known vulnerabilitiesVulnerability blocking
- Resolve internal names from your own registryDependency confusion
- Block packages by licenseLicense enforcement
- Run image pulls through the same rulesContainer firewalling
Try it on one registry
Point one package manager at Dependency Firewall and check the log after the next install. The trial runs 14 days.