Rules / GL039

GL039 Security-check command silenced with || true

Severity: warn
OWASP: CICD-SEC-1 – Insufficient Flow Control Mechanisms

What glsec checks

glsec flags script lines where a known security audit tool is followed by || true or || exit 0. These constructs force exit code 0 regardless of whether vulnerabilities were found, making the job always green and silently discarding the audit result. The pipeline continues as if no findings exist.

Detected tools: npm audit, composer audit, trivy, grype, snyk, osv-scanner, retire, safety check/scan, anchore-cli, inspector check, syft.

Trigger example

security:
  script:
    - npm audit --audit-level=high || true    # CVEs silently ignored
    - trivy image myapp:latest || true        # vulnerabilities discarded

Safe alternatives

Remove the silencing and fix the findings:

security:
  script:
    - npm audit --audit-level=high

If the pipeline must stay green while the backlog is being cleared, use job-level allow_failure: — this keeps the signal visible in the UI:

security:
  allow_failure: true
  script:
    - npm audit --audit-level=high

References

• GL008: allow_failure: true on a GitLab security scan job
• GL024: shell pipe without set -o pipefail

See also

Enable the ShellCheck integration to surface additional shell issues in these script blocks.

Documentation for glsec 1.23.0. Source of this page · Rule implementation