Requirement status
Each security requirement has a status indicating whether it has been addressed:Severity levels
Severity indicates how urgent a requirement is and guides your response:Check status
Oplane posts an Oplane Security Review check on each PR/MR with one of these conclusions:
By default the failure threshold is off and unresolved requirements report Neutral, which GitHub and GitLab treat as passing. Set a failure threshold per repository to have the check report Fail when unresolved requirements reach a severity you care about — combined with your branch protection rules, this acts as a merge gate. See Check failure threshold.
Info severity is advisory and never contributes to the failure threshold, even when the threshold is set to Any severity.
Comment structure
Each review comment Oplane posts on your PR/MR contains requirements grouped by resolution:Unresolved requirements
Requirements that still need attention. Each row shows the requirement title, severity, and current state.Resolved requirements
Requirements that have been addressed — either implemented, marked as out of scope, or accepted as risk.Working with Requirements
Learn how to respond to requirements and run local checks.