Dismissed isn't accepted

The organization

Organization: Prairieview Food Network (fictional)
Industry: Nonprofit: a regional food bank
Size: About 60 staff and several hundred volunteers; a two-person web team plus volunteer developers
Risk appetite: Low tolerance for exposure of donor payment or personal data; moderate tolerance for delays to internal tools.

Constraints

The food bank runs a donation website and a volunteer scheduling app. Every release has to pass the scanner in the build pipeline.
The spring donation campaign launches Friday. The volunteer development lead proposes dismissing all five open scanner alerts so the pipeline goes green and the release ships.
Under the food bank's policy, the owner of a system accepts its risks. The Director of Development, who leads fundraising, owns the donation platform. The development lead maintains the systems as their custodian.

Remediation capacity: 2 findings. You can choose "Mitigate: remediate ("fix")" for at most 2.

You have 2 remediation slots.

F1 Critical advisory in the donation page's form library

The scanner reports a Critical advisory in the form library the donation page is built on. The page calls the affected function when donors submit their details. A patched version of the library is available, and upgrading takes about a day of work and testing.

Asset: Donation page on the public website
Exposure: Internet-facing
CVSS base score: 9.1
Known to be exploited: No
Data involved: Donor names, contact details and payment form data
Compensating controls available: Turn off the affected form feature until the upgrade (partial)
Remediation effort: Low
Business owner: Director of Development

Your response to F1

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

F2 Critical advisory in a test tool that runs only in the build pipeline

The scanner reports a Critical advisory in a testing tool. The tool runs in the build pipeline to check the donation site before release and isn't part of the site that's deployed. The test step has no access to deployment keys and runs on test data only. A newer version fixes the advisory but changes how tests are written, so the web team planned the upgrade for its next maintenance cycle.

Asset: Build pipeline test tooling
Exposure: Internal network
CVSS base score: 9.8
Known to be exploited: No
Data involved: Test data only (no donor data)
Compensating controls available: Run the test step without network access (partial)
Remediation effort: Medium
Business owner: Director of Development

Your response to F2

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

F3 Unused SMS reminder integration built on an unmaintained SDK

The volunteer scheduling app still contains code that sent shift reminders by text message. Nobody has used it since last year, when volunteers moved to email reminders. The SDK it's built on is no longer maintained and has an open advisory. The SMS provider's API key in the app's settings is still active.

Asset: SMS reminder code in the volunteer scheduling app
Exposure: Third party
CVSS base score: 7.5
Known to be exploited: No
Data involved: Volunteer names and phone numbers
Compensating controls available: Limit the SMS API key to the app server's address
Remediation effort: Low
Business owner: Volunteer Program Manager

Your response to F3

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

F4 Flaw in the donor CRM vendor's hosted sign-up widget

The website's newsletter page, separate from the donation page, embeds a sign-up widget hosted by the food bank's donor CRM vendor. The scanner flags a flaw in the widget's script that could let an attacker alter the widget's own sign-up form. The development lead says it's the vendor's code, so there's nothing to do. The vendor contract has terms on patch timelines, breach notification and liability.

Asset: Donor CRM sign-up widget on the website's newsletter page
Exposure: Third party
CVSS base score: 6.1
Known to be exploited: No
Data involved: Donor names and email addresses
Compensating controls available: Remove the widget from the site until the vendor fixes it
Remediation effort: Low
Business owner: Director of Development

Your response to F4

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

F5 Payment processor API key committed to the public repository

The secret scanner found a live payment processor API key in the donation site's public code repository. A volunteer committed it three weeks ago while testing. The key can read transaction records and issue refunds.

Asset: Payment processor account
Exposure: Internet-facing
CVSS base score: None (not a scored vulnerability)
Known to be exploited: No
Data involved: Donation transactions and donor payment records
Compensating controls available: Narrow the key's permissions in the processor's dashboard (partial)
Remediation effort: Low
Business owner: Director of Development

Your response to F5

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

Overall note (optional, up to 1200 characters; shown back to you, never stored)

Your rationale and note are shown back to you once and never stored. Privacy