feat(security): gate deploys on exploitation risk, not just severity (#1432)

Scan-policy deploy gates can now block on a known-exploited CVE (CISA KEV)
and on a fixable Critical/High finding, in addition to an optional severity
threshold. New policies default risk-first (KEV and fixable on, severity off);
existing policies keep their severity-only behavior. CVSS stays captured for
context but is never the sole basis for a block, and a finding whose
exploitability cannot be confirmed is treated as risky rather than safe
(incomplete scan detail fails closed on KEV/fixable inputs).

The decision logic is shared between the pre-deploy gate and the informational
post-scan banner via a pure helper, so the two never disagree. Block messages
and the block dialog now name the conditions an image matched. Backend and
frontend gates move together, the new inputs replicate across the fleet, and a
blocking policy with no active input is rejected on both sides.

frontend/src/components/security/ScanPolicyManager.tsx

@@ -31,14 +31,23 @@ interface PolicyFormState {
   max_severity: VulnSeverity;
   block_on_deploy: boolean;
   enabled: boolean;
+  block_on_severity: boolean;
+  block_on_kev: boolean;
+  block_on_fixable: boolean;
 }
 
+// New policies default risk-first (block on known-exploited and on fixable
+// Critical/High), with the raw severity threshold off until the operator turns
+// it on. Existing policies keep whatever they were saved with.
 const EMPTY_FORM: PolicyFormState = {
   name: '',
   stack_pattern: '',
   max_severity: 'CRITICAL',
   block_on_deploy: false,
   enabled: true,
+  block_on_severity: false,
+  block_on_kev: true,
+  block_on_fixable: true,
 };
 
 /**
@@ -184,6 +193,9 @@ export function ScanPolicyManager() {
       max_severity: policy.max_severity,
       block_on_deploy: policy.block_on_deploy === 1,
       enabled: policy.enabled === 1,
+      block_on_severity: policy.block_on_severity === 1,
+      block_on_kev: policy.block_on_kev === 1,
+      block_on_fixable: policy.block_on_fixable === 1,
     });
     setDialogOpen(true);
   };
@@ -193,6 +205,12 @@ export function ScanPolicyManager() {
       toast.error('Policy name is required');
       return;
     }
+    // A blocking policy with no active input would block nothing; the backend
+    // rejects it too. Catch it here so the operator gets immediate feedback.
+    if (form.block_on_deploy && !form.block_on_severity && !form.block_on_kev && !form.block_on_fixable) {
+      toast.error('Enable at least one input (severity, KEV, or fixable) to block on deploy.');
+      return;
+    }
     setSaving(true);
     try {
       const payload = {
@@ -201,6 +219,9 @@ export function ScanPolicyManager() {
         max_severity: form.max_severity,
         block_on_deploy: form.block_on_deploy ? 1 : 0,
         enabled: form.enabled ? 1 : 0,
+        block_on_severity: form.block_on_severity ? 1 : 0,
+        block_on_kev: form.block_on_kev ? 1 : 0,
+        block_on_fixable: form.block_on_fixable ? 1 : 0,
       };
       const url = editingId ? `/security/policies/${editingId}` : '/security/policies';
       const method = editingId ? 'PUT' : 'POST';
@@ -338,7 +359,7 @@ export function ScanPolicyManager() {
         <SettingsCallout
           icon={<ShieldCheck className="h-4 w-4" />}
           title="No scan policies configured"
-          subtitle="Add one to enforce severity thresholds across your fleet."
+          subtitle="Add one to gate deploys on known-exploited, fixable, or high-severity findings across your fleet."
         />
       )}
 
@@ -349,9 +370,21 @@ export function ScanPolicyManager() {
               <div className="flex items-center gap-2 min-w-0">
                 <ShieldCheck className="w-4 h-4 text-muted-foreground shrink-0" strokeWidth={1.5} />
                 <span className="font-medium text-sm truncate">{policy.name}</span>
-                <Badge variant="outline" className="text-[10px] shrink-0">
-                  max: {policy.max_severity}
-                </Badge>
+                {policy.block_on_severity === 1 && (
+                  <Badge variant="outline" className="text-[10px] shrink-0">
+                    max: {policy.max_severity}
+                  </Badge>
+                )}
+                {policy.block_on_kev === 1 && (
+                  <Badge variant="outline" className="text-[10px] shrink-0">
+                    KEV
+                  </Badge>
+                )}
+                {policy.block_on_fixable === 1 && (
+                  <Badge variant="outline" className="text-[10px] shrink-0">
+                    Fixable
+                  </Badge>
+                )}
                 {policy.block_on_deploy === 1 && (
                   <Badge variant="destructive" className="text-[10px] shrink-0">
                     block
@@ -439,21 +472,62 @@ export function ScanPolicyManager() {
             </p>
           </div>
           <div className="space-y-2">
-            <Label>Max severity</Label>
-            <Combobox
-              options={SEVERITY_OPTIONS}
-              value={form.max_severity}
-              onValueChange={(v) => setForm({ ...form, max_severity: v as VulnSeverity })}
-            />
+            <Label>Block conditions</Label>
+            <p className="text-xs text-muted-foreground">
+              What makes this policy flag an image. Enable at least one to block on deploy. CVSS is always captured for context but never the sole basis.
+            </p>
+            <div className="rounded-lg border border-glass-border px-3 py-2.5 space-y-2.5">
+              <div className="flex items-center justify-between gap-3">
+                <div>
+                  <Label className="text-sm">Severity threshold</Label>
+                  <p className="text-xs text-muted-foreground">Flag an image whose highest finding meets or exceeds the chosen severity.</p>
+                </div>
+                <TogglePill
+                  aria-label="Severity threshold"
+                  checked={form.block_on_severity}
+                  onChange={(c) => setForm({ ...form, block_on_severity: c })}
+                />
+              </div>
+              {form.block_on_severity && (
+                <Combobox
+                  options={SEVERITY_OPTIONS}
+                  value={form.max_severity}
+                  onValueChange={(v) => setForm({ ...form, max_severity: v as VulnSeverity })}
+                />
+              )}
+            </div>
+            <div className="flex items-center justify-between gap-3 rounded-lg border border-glass-border px-3 py-2.5">
+              <div>
+                <Label className="text-sm">Known-exploited (KEV)</Label>
+                <p className="text-xs text-muted-foreground">Flag an image carrying a CVE on the CISA known-exploited list.</p>
+              </div>
+              <TogglePill
+                aria-label="Known-exploited (KEV)"
+                checked={form.block_on_kev}
+                onChange={(c) => setForm({ ...form, block_on_kev: c })}
+              />
+            </div>
+            <div className="flex items-center justify-between gap-3 rounded-lg border border-glass-border px-3 py-2.5">
+              <div>
+                <Label className="text-sm">Fixable Critical/High</Label>
+                <p className="text-xs text-muted-foreground">Flag an image with a Critical or High finding that has a fix available.</p>
+              </div>
+              <TogglePill
+                aria-label="Fixable Critical/High"
+                checked={form.block_on_fixable}
+                onChange={(c) => setForm({ ...form, block_on_fixable: c })}
+              />
+            </div>
           </div>
           <div className="flex items-center justify-between rounded-lg border border-glass-border px-3 py-2.5">
             <div>
               <Label className="text-sm">Block on deploy</Label>
               <p className="text-xs text-muted-foreground">
-                Reject a deploy before containers start when any image meets or exceeds the threshold. With this off, the policy only evaluates and raises an alert.
+                Reject a deploy before containers start when any image matches the block conditions above. With this off, the policy only evaluates and raises an alert.
               </p>
             </div>
             <TogglePill
+              aria-label="Block on deploy"
               checked={form.block_on_deploy}
               onChange={(c) => setForm({ ...form, block_on_deploy: c })}
             />

frontend/src/components/security/__tests__/ScanPolicyManager.test.tsx

@@ -5,7 +5,8 @@
  * configured".
  */
 import { it, expect, vi, beforeEach } from 'vitest';
-import { render, screen, waitFor } from '@testing-library/react';
+import { render, screen, waitFor, fireEvent, within } from '@testing-library/react';
+import { toast } from '@/components/ui/toast-store';
 
 vi.mock('@/lib/api', () => ({ apiFetch: vi.fn() }));
 vi.mock('@/context/LicenseContext');
@@ -70,3 +71,55 @@ it('shows the empty state when there are genuinely no policies', async () => {
   render(<ScanPolicyManager />);
   await waitFor(() => expect(screen.getByText('No scan policies configured')).toBeInTheDocument());
 });
+
+const riskPolicy = {
+  id: 1, name: 'risk-gate', node_id: null, node_identity: '', stack_pattern: null,
+  max_severity: 'CRITICAL', block_on_deploy: 1, enabled: 1,
+  block_on_severity: 0, block_on_kev: 1, block_on_fixable: 1,
+  replicated_from_control: 0, created_at: 1, updated_at: 1,
+};
+
+it('renders a per-input badge for each active input (KEV/Fixable, no severity)', async () => {
+  setup({ isPaid: true });
+  mockedFetch.mockImplementation((url: string) =>
+    Promise.resolve(url.startsWith('/fleet/role') ? jsonResponse(200, { role: 'control' }) : jsonResponse(200, [riskPolicy])),
+  );
+  render(<ScanPolicyManager />);
+  await waitFor(() => expect(screen.getByText('risk-gate')).toBeInTheDocument());
+  expect(screen.getByText('KEV')).toBeInTheDocument();
+  expect(screen.getByText('Fixable')).toBeInTheDocument();
+  expect(screen.queryByText(/^max:/)).not.toBeInTheDocument();
+});
+
+it('sends the risk-first defaults (KEV + fixable on, severity off) when creating a policy', async () => {
+  setup({ isPaid: true });
+  render(<ScanPolicyManager />);
+  await waitFor(() => expect(screen.getByText('Add policy')).toBeInTheDocument());
+  fireEvent.click(screen.getByText('Add policy'));
+  fireEvent.change(screen.getByLabelText('Name'), { target: { value: 'new-gate' } });
+  fireEvent.click(screen.getByRole('button', { name: 'Create' }));
+
+  await waitFor(() => {
+    const call = mockedFetch.mock.calls.find(([url, opts]) => url === '/security/policies' && opts?.method === 'POST');
+    expect(call).toBeTruthy();
+    const body = JSON.parse((call![1] as { body: string }).body);
+    expect(body).toMatchObject({ block_on_severity: 0, block_on_kev: 1, block_on_fixable: 1 });
+  });
+});
+
+it('blocks a save that turns on block-on-deploy with no active input', async () => {
+  setup({ isPaid: true });
+  render(<ScanPolicyManager />);
+  await waitFor(() => expect(screen.getByText('Add policy')).toBeInTheDocument());
+  fireEvent.click(screen.getByText('Add policy'));
+  fireEvent.change(screen.getByLabelText('Name'), { target: { value: 'empty-gate' } });
+
+  const dialog = screen.getByRole('dialog');
+  fireEvent.click(within(dialog).getByRole('switch', { name: 'Known-exploited (KEV)' })); // KEV off
+  fireEvent.click(within(dialog).getByRole('switch', { name: 'Fixable Critical/High' })); // fixable off
+  fireEvent.click(within(dialog).getByRole('switch', { name: 'Block on deploy' })); // block-on-deploy on
+  fireEvent.click(screen.getByRole('button', { name: 'Create' }));
+
+  expect(toast.error).toHaveBeenCalledWith(expect.stringMatching(/at least one input/i));
+  expect(mockedFetch.mock.calls.some(([url, opts]) => url === '/security/policies' && opts?.method === 'POST')).toBe(false);
+});

frontend/src/components/stack/PolicyBlockDialog.tsx

@@ -5,23 +5,59 @@ import {
   ModalFooter,
 } from '@/components/ui/modal';
 import { Button } from '@/components/ui/button';
+import { Badge } from '@/components/ui/badge';
 import { SeverityChip } from '@/components/VulnerabilityScanSheet';
 import type { VulnSeverity } from '@/types/security';
 
+/** Risk inputs a deploy gate can block on; mirrors the backend reason set. */
+export type PolicyBlockReason = 'severity' | 'kev' | 'fixable';
+
 export interface PolicyBlockViolation {
   imageRef: string;
   severity: VulnSeverity | string;
   criticalCount: number;
   highCount: number;
+  kevCount: number;
+  fixableCount: number;
+  /** Which inputs matched (empty when the image could not be scanned). */
+  reasons: PolicyBlockReason[];
   scanId: number;
 }
 
 export interface PolicyBlockPayload {
   error: string;
-  policy: { id: number; name: string; maxSeverity: string } | null;
+  policy:
+    | {
+        id: number;
+        name: string;
+        maxSeverity: string;
+        // Active inputs (0/1). Absent on older control payloads, where the
+        // dialog falls back to severity-only wording.
+        blockOnSeverity?: number;
+        blockOnKev?: number;
+        blockOnFixable?: number;
+      }
+    | null;
   violations: PolicyBlockViolation[];
 }
 
+const REASON_LABEL: Record<PolicyBlockReason, string> = {
+  severity: 'Severity',
+  kev: 'KEV',
+  fixable: 'Fixable',
+};
+
+/** Plain-language list of the inputs a policy blocks on, for the dialog copy. */
+function describePolicyInputs(policy: PolicyBlockPayload['policy']): string {
+  if (!policy) return 'its scan policy conditions';
+  const parts: string[] = [];
+  if (policy.blockOnSeverity) parts.push(`severity at or above ${policy.maxSeverity}`);
+  if (policy.blockOnKev) parts.push('a known-exploited CVE (KEV)');
+  if (policy.blockOnFixable) parts.push('a fixable Critical/High finding');
+  // Older payloads omit the flags entirely; describe the severity threshold.
+  return parts.length > 0 ? parts.join(', ') : `severity at or above ${policy.maxSeverity}`;
+}
+
 /** The only stack operations the backend scan-policy gate can reject. */
 export type PolicyBlockableAction = 'deploy' | 'update' | 'rollback';
 
@@ -52,7 +88,7 @@ export function PolicyBlockDialog({
   onBypass,
 }: PolicyBlockDialogProps) {
   const policyName = payload?.policy?.name ?? 'policy';
-  const maxSeverity = payload?.policy?.maxSeverity ?? '';
+  const inputsText = describePolicyInputs(payload?.policy ?? null);
   const violations = payload?.violations ?? [];
 
   return (
@@ -60,13 +96,12 @@ export function PolicyBlockDialog({
       <ModalDestructiveHeader
         kicker={`${stackName.toUpperCase()} · SCAN POLICY · BLOCKED`}
         title="Deploy blocked by security policy"
-        description={`Policy ${policyName} blocks deploys when any image meets or exceeds ${maxSeverity}.`}
+        description={`Policy ${policyName} blocks deploys on ${inputsText}.`}
       />
       <ModalBody>
         <p className="text-sm text-muted-foreground">
           Policy <span className="font-medium text-foreground">{policyName}</span> blocks deploys
-          when any image meets or exceeds{' '}
-          <span className="font-medium text-foreground">{maxSeverity}</span>.{' '}
+          on <span className="font-medium text-foreground">{inputsText}</span>.{' '}
           The following {violations.length === 1 ? 'image' : `${violations.length} images`} triggered the block.
         </p>
         <div className="border border-glass-border bg-card/60 shadow-card-bevel divide-y divide-glass-border">
@@ -81,7 +116,18 @@ export function PolicyBlockDialog({
                   <div className="font-mono text-sm truncate">{v.imageRef}</div>
                   <div className="font-mono text-[10px] uppercase tracking-[0.18em] text-stat-subtitle tabular-nums">
                     {v.criticalCount} critical &middot; {v.highCount} high
+                    {v.kevCount > 0 && <> &middot; {v.kevCount} KEV</>}
+                    {v.fixableCount > 0 && <> &middot; {v.fixableCount} fixable</>}
                   </div>
+                  {(v.reasons ?? []).length > 0 && (
+                    <div className="flex flex-wrap gap-1 mt-1.5">
+                      {(v.reasons ?? []).map((r) => (
+                        <Badge key={r} variant="destructive" className="text-[10px]">
+                          {REASON_LABEL[r]}
+                        </Badge>
+                      ))}
+                    </div>
+                  )}
                 </div>
                 <SeverityChip severity={normalizeSeverity(String(v.severity))} />
               </div>

frontend/src/components/stack/__tests__/PolicyBlockDialog.test.tsx

@@ -0,0 +1,43 @@
+import { describe, it, expect, vi } from 'vitest';
+import { render, screen } from '@testing-library/react';
+import { PolicyBlockDialog, type PolicyBlockPayload } from '../PolicyBlockDialog';
+
+const payload: PolicyBlockPayload = {
+  error: 'blocked',
+  policy: { id: 1, name: 'prod-gate', maxSeverity: 'CRITICAL', blockOnSeverity: 0, blockOnKev: 1, blockOnFixable: 1 },
+  violations: [
+    { imageRef: 'nginx:1.14', severity: 'CRITICAL', criticalCount: 2, highCount: 0, kevCount: 1, fixableCount: 1, reasons: ['kev', 'fixable'], scanId: 1 },
+  ],
+};
+
+describe('PolicyBlockDialog', () => {
+  it('describes the active inputs (KEV + fixable, not the severity threshold)', () => {
+    render(
+      <PolicyBlockDialog open payload={payload} stackName="web" canBypass={false} bypassing={false} onClose={vi.fn()} onBypass={vi.fn()} />,
+    );
+    const desc = screen.getAllByText(/known-exploited CVE \(KEV\)/i);
+    expect(desc.length).toBeGreaterThan(0);
+    expect(screen.getAllByText(/fixable Critical\/High finding/i).length).toBeGreaterThan(0);
+  });
+
+  it('renders a reason badge per matched input on the violation row', () => {
+    render(
+      <PolicyBlockDialog open payload={payload} stackName="web" canBypass={false} bypassing={false} onClose={vi.fn()} onBypass={vi.fn()} />,
+    );
+    expect(screen.getByText('KEV')).toBeInTheDocument();
+    expect(screen.getByText('Fixable')).toBeInTheDocument();
+    expect(screen.getByText(/1 KEV/)).toBeInTheDocument();
+  });
+
+  it('falls back to severity wording when input flags are absent (older payload)', () => {
+    const legacy: PolicyBlockPayload = {
+      error: 'blocked',
+      policy: { id: 1, name: 'old-gate', maxSeverity: 'HIGH' },
+      violations: [{ imageRef: 'redis:7', severity: 'HIGH', criticalCount: 0, highCount: 1, kevCount: 0, fixableCount: 0, reasons: [], scanId: 2 }],
+    };
+    render(
+      <PolicyBlockDialog open payload={legacy} stackName="web" canBypass={false} bypassing={false} onClose={vi.fn()} onBypass={vi.fn()} />,
+    );
+    expect(screen.getAllByText(/severity at or above HIGH/i).length).toBeGreaterThan(0);
+  });
+});