Exceptions
Field-level reference for firewall rule exceptions and the exception reason vocabulary.
An exception waives one rule for requests matching its selector. It is consulted only after the rule's own selector has matched, and only while unexpired. For the mental model, see Exception model; for workflows, see Manage exceptions.
Shape
{
"id": "allow-lodash-41720",
"rule": "block-critical-vulns",
"selector": { "packageName": "lodash", "version": "4.17.20" },
"log": true,
"expires": "2026-08-01T00:00:00Z",
"reason": "not_exploitable",
"notes": "Not reachable from our code. JIRA-1234."
}Fields
| Field | Type | Description |
|---|---|---|
id | string | Unique within the firewall. Recorded on log entries for requests the exception allowed |
rule | string | ID of the rule this exception waives. Exactly one rule per exception |
selector | object | Same shape as a rule selector, including wildcards and functions. Scope narrowly |
log | boolean | Write a log entry (message EXCEPTION, carrying the exception ID) when the exception allows a request |
expires | string | RFC 3339 timestamp. From this moment the exception stops matching and the rule applies again. Optional; omitted means no expiry |
reason | string | One of the reason codes below |
notes | string | Free text; the place for ticket links and justification detail |
Reasons
| Config value | Dashboard label | Meaning |
|---|---|---|
acknowledged_violation | Acknowledged Violation | The violation is known and accepted for now |
evaluating_component | Evaluating Component | The package is under assessment, temporary access |
mitigated_externally | Mitigated Externally | The risk is handled outside the package, for example WAF or configuration |
no_upgrade_path | No Upgrade Path | No fixed version is available yet |
not_exploitable | Not Exploitable | The vulnerability cannot be triggered in this usage |
not_reachable | Not Reachable | The vulnerable code path is not reachable |
other | Other | Anything else, explained in notes |
Evaluation semantics
- The exception is checked only after its rule's selector matched the request.
- Expired exceptions are skipped entirely, as if deleted.
- If several exceptions on a rule exist, the first match wins; further exceptions and the rule's effect are not evaluated for that request.
- An exception affects only its own rule. All other rules still see the request.
Related
- Concept: Exception model, Rule evaluation
- How-to: Manage exceptions
- Reference: Rules and selectors