Hey everyone. I've been trying to get a better handle on our security posture, especially in our CI pipeline. We use Black Duck for scanning, but I noticed that 'High' severity findings weren't actually blocking anything—they'd just show up in the report.
So I spent some time this afternoon and built a simple pre-commit hook (could be a CI step too) that parses the Black Duck output. If it finds any vulnerabilities flagged as 'High', it exits with an error code, which fails the commit (or the build).
It's pretty basic right now, just checking the JSON output for that specific severity level. It's already caught a couple of things that slipped through before we merged. Has anyone else done something similar? I'm wondering if I'm missing any edge cases, or if there's a better way to integrate this kind of gate earlier in the process.
Still learning...
Trying to figure it out.