Skip to main content

Technical debt

Technical debt in Musha refers to security vulnerabilities that existed in your codebase before a PR was opened, not introduced by the PR itself.

The problem this solves​

Most security scanners block PRs for any vulnerability above a threshold, even if the developer who opened the PR didn't introduce it. This leads to:

  • PRs blocked by vulns the developer has no context on
  • Teams disabling the scanner to "move fast"
  • Security theater instead of real security improvement

How Musha identifies technical debt​

On a pull request scan, the CI job tells Musha which lines the pull request added (the added_lines field). Musha compares each finding's location against them.

  • A finding on a line the pull request added was introduced by this PR, so it is new. It blocks if its severity is at or above your threshold.
  • A finding anywhere else is pre-existing, so it is technical debt. It never blocks the pull request by itself.

The GitHub action computes added_lines for you, which is why it needs fetch-depth: 0 on checkout. The generated GitLab, Azure DevOps and Bitbucket pipelines do the same with the full history they clone.

If the diff can't be computed, Musha doesn't assume the pull request touched nothing: it falls back to a repository-wide view instead.

Blocking policy​

Set in Settings > Scan Policy, and applied on the server:

  • Block severity. The lowest severity that blocks a merge. The default is Critical only.
  • Tracked debt never blocks. A pre-existing finding that is already in your repository backlog appears in the comment as context only.
  • Block untracked pre-existing findings (off by default). Turn it on to also block on pre-existing findings that are not yet in the backlog, for example because the repository has never had a full scan.
  • Accepted risks don't block. You can accept a finding from the pull request with a reason, and it is recorded.

The pull request comment​

The comment on the pull request lists the findings grouped by what they mean for the merge: blocking, non-blocking, accepted risks and technical debt. Only blocking findings make the scan blocked.

Limitation​

The distinction relies on knowing which lines the pull request added. When Musha can't tell, it errs on the side of not blaming the author for what was already there.