OSS
/oss/en/openforge/standards/security-exceptions

Security Exceptions & Waivers

Time-bounded exception handling, risk ownership, and expiration auditing.

Security Exceptions & Waivers

Security exceptions are controlled, time-bounded risk decisions rather than permanent waivers.

Waiver Rules

  • Formal Documentation: Explicit scope, technical justification, mitigating controls, and risk owner.
  • Time-Bounded Expiration: Maximum 90-day expiration window requiring formal renewal reviews.
  • No Silent Suppressions: Security gates must not silently ignore failures without documented waivers.

Canonical Source