Security Gates
Define objective, documented criteria that a release must meet before it can progress.
IntermediateSecurity GatesGovernanceApplication
Where it fits in the lifecycle
- Plan
- Code
- Build
- Test
- Release
- Deploy
- Operate
- Monitor
- Test Dynamic testing, integration security tests and security gates.
- Release Approval controls, artefact promotion and provenance.
Overview
A gate turns scan output into a pass/fail decision using thresholds the team agreed to: severity, fix availability, age of finding and asset criticality.
Why it matters
Without explicit criteria, every release becomes a negotiation and scan results are ignored.
How it works
- 01Scanners emit machine-readable reports.
- 02A policy evaluates reports against thresholds.
- 03Failures block promotion; documented exceptions expire automatically.
Common tools
Open Policy AgentGitLabGitHubGitLabGitHubJenkins
Implementation examples
bashThreshold gate
trivy image --exit-code 1 \ --severity CRITICAL \ --ignore-unfixed \ "$IMAGE"Best practices
- Start narrow and tighten.
- Give every exception an owner and expiry.
- Make gate criteria visible to developers.
Common mistakes
- Blocking on all severities immediately, which leads to blanket bypasses.
Hands-on labs
- Lab 06 — Build a Secure CI/CD Pipeline
Assemble a pipeline containing SAST, SCA, secret detection, container scanning, SBOM generation and a security gate.