adapters/v1/backend.go (1)

67-70: Guard SetSecurityExceptionAdapter against nil input.

If a nil adapter is passed, Line 69 stores a method value on a nil receiver and can panic later when invoked.

Proposed defensive fix

 func (a *BackendAdapter) SetSecurityExceptionAdapter(adapter *SecurityExceptionAdapter) {
-	a.securityExceptionAdapter = adapter
-	a.getSecurityExceptionsFunc = adapter.GetSecurityExceptions
+	a.securityExceptionAdapter = adapter
+	if adapter == nil {
+		a.getSecurityExceptionsFunc = nil
+		return
+	}
+	a.getSecurityExceptionsFunc = adapter.GetSecurityExceptions
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@adapters/v1/backend.go` around lines 67 - 70, Guard
SetSecurityExceptionAdapter against nil by checking the adapter parameter before
assigning fields: in BackendAdapter.SetSecurityExceptionAdapter, if adapter is
nil, set a.securityExceptionAdapter and a.getSecurityExceptionsFunc to nil (or
leave them unchanged if that’s desired) and return; otherwise assign
a.securityExceptionAdapter = adapter and a.getSecurityExceptionsFunc =
adapter.GetSecurityExceptions. This prevents storing a method value bound to a
nil receiver and avoids panics when invoking getSecurityExceptionsFunc.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

go.mod (1)

406-406: ⚠️ Potential issue | 🟠 Major

Bump vulnerable go.opentelemetry.io/otel/sdk to a patched version.

Line 406 still pins go.opentelemetry.io/otel/sdk to v1.42.0, which is flagged as affected by GHSA-hfvc-g4fc-pqhx. Please move to v1.43.0 or later.

Proposed fix

-	go.opentelemetry.io/otel/sdk v1.42.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.43.0 // indirect

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@go.mod` at line 406, Update the vulnerable dependency declaration for
go.opentelemetry.io/otel/sdk in go.mod from v1.42.0 to at least v1.43.0 (or a
newer patched release); edit the version string for the module entry
"go.opentelemetry.io/otel/sdk" and then run module tooling (e.g., go get
go.opentelemetry.io/otel/sdk@v1.43.0 and go mod tidy) to ensure the lockfile and
transitive deps are updated.

pkg/securityexception/v1/types.go (1)

7-101: Keep this CRD contract single-sourced.

This file is now a hand-maintained copy of a public schema. If the chart/storage definition changes first, unmarshalling will still succeed and the adapter can silently drift. Once the shared package is tagged again, prefer importing the canonical types or add a parity test against the shipped CRD schema.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@pkg/securityexception/v1/types.go` around lines 7 - 101, This CRD type file
is a hand-maintained duplicate of the canonical schema and can drift; replace
the duplicated definitions (e.g., SecurityException, ClusterSecurityException,
SecurityExceptionSpec, ExceptionMatch, ResourceMatch, VulnerabilityException,
VulnerabilityRef, PostureException, VulnerabilityStatus, PostureAction) by
importing the single-source canonical types from the shared CRD package once
that package is tagged (update imports and go.mod accordingly) or, if you cannot
import yet, add an automated parity test that compares these local structs/JSON
tags against the shipped CRD schema to fail CI on drift; remove or mark the
duplicated definitions as temporary and document the intent to switch to the
shared package when it’s available.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

adapters/v1/securityexception.go (1)

20-40: ⚠️ Potential issue | 🟠 Major

Fail closed on unsupported match fields to avoid scope widening.

Line 27/Line 38 eventually rely on Line 75–Line 112, which only maps resources (namespace/kind/name). namespaceSelector, objectSelector, images, and resource.apiGroup are dropped, so a scoped CRD can become broader than intended.

Proposed fix (skip unsafe conversions until full mapping is supported)

 func convertToVulnerabilityExceptionPolicies(exceptions []sev1beta1.SecurityException, clusterExceptions []sev1beta1.ClusterSecurityException) []armotypes.VulnerabilityExceptionPolicy {
 	var policies []armotypes.VulnerabilityExceptionPolicy

 	now := time.Now()

 	for i := range exceptions {
 		se := &exceptions[i]
 		if isExpired(se.Spec.ExpiresAt, now) {
 			continue
 		}
+		if hasUnsupportedMatch(se.Spec.Match) {
+			continue
+		}
 		namespace := se.Namespace
 		for _, vuln := range se.Spec.Vulnerabilities {
 			p := buildPolicy(se.Spec, vuln, namespace)
 			policies = append(policies, p)
 		}
 	}

 	for i := range clusterExceptions {
 		cse := &clusterExceptions[i]
 		if isExpired(cse.Spec.ExpiresAt, now) {
 			continue
 		}
+		if hasUnsupportedMatch(cse.Spec.Match) {
+			continue
+		}
 		for _, vuln := range cse.Spec.Vulnerabilities {
 			p := buildPolicy(cse.Spec, vuln, "")
 			policies = append(policies, p)
 		}
 	}

 	return policies
 }
+
+func hasUnsupportedMatch(match sev1beta1.ExceptionMatch) bool {
+	if match.NamespaceSelector != nil || match.ObjectSelector != nil || len(match.Images) > 0 {
+		return true
+	}
+	for _, r := range match.Resources {
+		if r.APIGroup != "" {
+			return true
+		}
+	}
+	return false
+}

Also applies to: 70-112

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@adapters/v1/securityexception.go` around lines 20 - 40, The current loop that
converts exceptions into policies calls buildPolicy for every non-expired
SecurityException (exceptions/clusterExceptions) but buildPolicy only maps
resources (namespace/kind/name) and ignores namespaceSelector, objectSelector,
images, and resource.apiGroup, which can widen scope; update the conversion
loops that use isExpired and buildPolicy to first detect and skip any exception
whose Spec contains unsupported match fields (namespaceSelector, objectSelector,
images, or resource.apiGroup) so we "fail closed" — i.e., do not convert those
entries into policies until buildPolicy (or the mapping code around lines
75–112) is extended to handle those fields; ensure both the exceptions and
clusterExceptions loops perform the same safety check before calling
buildPolicy.