Mitigations

The Mitigations tab allows you to track applied fixes, document risk acceptances, and manage false positives for vulnerabilities in your projects.

Overview

Not every vulnerability requires immediate remediation. Mitigations help you:

• Document why certain vulnerabilities don't apply
• Track accepted risks with expiration dates
• Mark false positives
• Record applied workarounds
• Maintain audit trails

Accessing Mitigations

1. Open a project from the Projects page
2. Navigate to the Mitigations tab
3. View all mitigation records

Mitigation Types

Risk Acceptance

Accept the risk of a vulnerability when:

• Vulnerability is not exploitable in your context
• Cost of remediation exceeds risk
• Fix would break critical functionality
• Temporary acceptance while planning remediation

False Positive

Mark as false positive when:

• Scanner incorrectly identified the vulnerability
• Component is not actually present
• Version detection was incorrect
• Different component with same name

Workaround Applied

Document workarounds when:

• Configuration change mitigates the issue
• Network controls prevent exploitation
• Compensating controls are in place
• Partial remediation applied

Not Applicable

Mark as not applicable when:

• Vulnerable code path is not used
• Feature is disabled
• Component is only in development
• Platform doesn't apply

Creating a Mitigation

From Vulnerabilities Tab

1. Navigate to Vulnerabilities tab
2. Find the vulnerability to mitigate
3. Click the ⋮ menu → Add Mitigation
4. Fill in mitigation details
5. Click Save

Mitigation Form

Managing Mitigations

Mitigation Status

Editing Mitigations

1. Click on a mitigation to view details
2. Click Edit
3. Update fields as needed
4. Click Save

Revoking Mitigations

1. Click on a mitigation
2. Click Revoke
3. Provide revocation reason
4. Mitigation becomes inactive

Bulk Mitigations

Apply mitigations to multiple vulnerabilities:

1. In Vulnerabilities tab, select multiple items
2. Click Bulk Actions → Add Mitigation
3. Fill in common mitigation details
4. Click Apply to Selected

Mitigation Policies

Create policies to auto-apply mitigations:

Policy Types

Creating a Policy

1. Go to Settings → Mitigation Policies
2. Click + New Policy
3. Configure policy rules
4. Set scope (organization or project)
5. Click Save

Expiration and Review

Setting Expiration

For risk acceptances, set an expiration date:

• 30 days - Short-term acceptance
• 90 days - Quarterly review cycle
• 180 days - Semi-annual review
• 365 days - Annual review
• Custom - Specific date

Expiration Notifications

Safeguard.sh notifies you before expiration:

• 14 days before expiration
• 7 days before expiration
• On expiration date

Reviewing Expired Mitigations

1. Go to Mitigations tab
2. Filter by Status: Expired
3. For each expired mitigation:
   • Extend expiration if still valid
   • Revoke if no longer applicable
   • Upgrade to fix if available

Audit Trail

All mitigation actions are logged:

Viewing Audit Trail

1. Click on a mitigation
2. Click History tab
3. View all changes

Reporting

Mitigation Reports

Generate mitigation reports:

1. Go to Reports → Mitigations
2. Select date range and filters
3. Choose format (PDF, CSV, Excel)
4. Download report

Report Contents

• Active mitigations summary
• Expired mitigations requiring review
• Mitigation by type breakdown
• Approver summary
• Expiration timeline

API Access

Manage mitigations via API:

# List mitigations for a project
curl -X GET https://api.safeguard.sh/v1/projects/{id}/mitigations \
  -H "Authorization: Bearer $API_KEY"

# Create a mitigation
curl -X POST https://api.safeguard.sh/v1/projects/{id}/mitigations \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "vulnerability_id": "CVE-2024-1234",
    "type": "risk_acceptance",
    "justification": "Not exploitable in our configuration",
    "expires_at": "2025-06-01T00:00:00Z"
  }'

Best Practices

Documentation

• Provide detailed justifications
• Reference external analysis if available
• Include ticket/issue numbers
• Document compensating controls

Review Process

• Require approval for risk acceptances
• Set appropriate expiration dates
• Review expirations promptly
• Re-evaluate when context changes

Organization

• Use consistent mitigation categories
• Define organizational policies
• Train team on mitigation process
• Regular mitigation audits

Integration with Gates

Mitigations affect security gate results:

• Active mitigations exclude vulnerabilities from gate failures
• Expired mitigations do not exclude vulnerabilities
• Policy-based mitigations apply automatically

Next Steps

• Vulnerabilities
• Policies & Gates
• AI Remediate