gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-13 04:06:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: make all security features available on every tier (#1502)

Browse Source 
Scan policies, deploy enforcement, the suppression-aware deploy-block
toggle, SARIF export, and OpenVEX export now work on Community, matching
the rest of the vulnerability-scanning surface that was already free.

Backend: drop the tier gate from the seven security routes and from the
dashboard configuration-status scan-policies row, so the Dashboard and
Fleet config cards stop hiding the Vulnerability scanning row. Reading
policies stays auth-only; mutations and exports stay admin-only.

Frontend: always show the Policies tab and panel, the SARIF and VEX
export actions, and the honor-suppressions toggle for admins.

Docs: move scan policies, SARIF, and OpenVEX to every tier across the
feature and API-reference pages; clarify that Fleet Sync's cross-node
replication remains the paid part.
This commit is contained in:
Anso
2026-06-28 08:14:21 -04:00
committed by GitHub
parent 05c483f213
commit 04e69021e0
27 changed files with 153 additions and 179 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/api-reference/overview.mdx
+1 -1
View File
@@ -116,7 +116,7 @@ Some endpoints are gated by license tier:
| Tier | Gated features |
|------|---------------|
| **Admiral** | Scan policies, Private registries |
| **Admiral** | Private registries (AWS ECR) |
Requests to gated endpoints on Community return `403` with the `PAID_REQUIRED` error code.
docs/api-reference/security.mdx
+5 -5
View File
@@ -5,7 +5,7 @@ description: Automate scan policies, CVE suppressions, and vulnerability scans f
The Security API lets you manage scan policies, CVE suppressions, and trigger vulnerability scans from CI pipelines and automation scripts. Every endpoint in this reference is intended for external automation; internal frontend-only endpoints (finding listings, SARIF downloads) are not documented here.
All endpoints require [Bearer token authentication](/api-reference/overview#authentication). Manual scans, secret and misconfiguration results, scan comparison, and CVE suppressions are available on every tier. Scan policies (with `block_on_deploy` enforcement), SBOM, and SARIF require Admiral. See the per-endpoint **License** row for details.
All endpoints require [Bearer token authentication](/api-reference/overview#authentication). Every endpoint in this reference is available on every tier, including scan policies with `block_on_deploy` enforcement. See the per-endpoint **Role** row for the admin requirement on writes.
## Scan policies
@@ -17,7 +17,7 @@ Writes are admin-only and rejected on replica nodes (policies are managed on the
**`GET /api/security/policies`**
**License:** Admiral
**License:** Community
```bash
curl -H "Authorization: Bearer YOUR_API_TOKEN" \
@@ -51,7 +51,7 @@ curl -H "Authorization: Bearer YOUR_API_TOKEN" \
**`POST /api/security/policies`**
**License:** Admiral · **Role:** Admin
**License:** Community · **Role:** Admin
| Field | Type | Required | Description |
|-------|------|:--------:|-------------|
@@ -93,7 +93,7 @@ curl -X POST https://your-sencho-instance:1852/api/security/policies \
**`PUT /api/security/policies/{id}`**
**License:** Admiral · **Role:** Admin
**License:** Community · **Role:** Admin
Any of the create fields can be updated individually. Omitted fields are left unchanged.
@@ -112,7 +112,7 @@ curl -X PUT https://your-sencho-instance:1852/api/security/policies/1 \
**`DELETE /api/security/policies/{id}`**
**License:** Admiral · **Role:** Admin
**License:** Community · **Role:** Admin
```bash
curl -X DELETE https://your-sencho-instance:1852/api/security/policies/1 \