Feature Requests

As a security engineer, I seek to run SCA (software component analysis) scans as late in the CICD process as possible (shift right). However I do not want to block releases at this point. What I DO want is for vulnerabilities discovered at this late stage to auto request an exemption, and for the exemption to be automatically granted, and for the duration of the exemption to be configurable to my organizations SLO for remediating security findings. The vulnerability severity needs to be configurable, but for our needs it's High and Critical. Additionally, notification to myself, repo owners, security staff via email would be amazing.

This request is to create a Feature Request for AWS connector to support role key, secret and session token

Similar to the CD module user would like to have the Approval as a CI step.

Provide a general Cache Intelligence capability to prevent build-generated artifacts from being persisted and accumulating in dependency caches. Some customers are experiencing this with Maven, where their cached .m2 directory contains both reusable dependencies and versioned build artifacts. With pull-push and cache overwrite enabled, each build adds a new versioned artifact to the cache, causing the cache to continuously grow. The current workaround requires customers to modify their build process or manually remove artifacts before the cache is saved. We would like a more native solution that allows Cache Intelligence to distinguish reusable dependencies from build-specific/generated content and prevent the latter from accumulating. This should be a general solution applicable beyond Maven to other build tools and dependency managers. Customer Impact: Unbounded cache growth increases storage consumption, cache save/restore times, and infrastructure costs, while requiring additional pipeline customization and maintenance.

Problem IaCM currently has no equivalent of CD's Deployment Freeze Window. Freeze windows today can only be configured for CD modules (services/environments) — there's no option to freeze IaCM workspaces/pipelines. Customer use case Twilio periodically performs maintenance on Harness delegates (destroying and recreating them), during which delegates are unavailable for ~1 hour. Their IaCM pipelines (plan/apply) depend on those delegates, so any pipeline triggered during that window fails. They want a way to prevent IaCM pipelines from being triggered while delegate maintenance is in progress — i.e., a scheduled freeze window scoped to IaCM workspaces/pipelines, matching the capability CD already has. Current workarounds: OPA + Manual Approval gates — requires custom policy authoring per workspace/pipeline; not a first-class scheduled freeze. Queue + Barrier steps with Approvals — same limitation; approval-based, not time-window-based, and puts the onus on manual intervention during the freeze rather than blocking automatically. Manually locking the workspace — only viable if the freeze is workspace-scoped, and requires manual toggling before/after every maintenance window rather than a scheduled window. None of these give a native, scheduled "no pipelines will run in this window" guarantee the way CD's freeze feature does. Ask Add Deployment Freeze Window support for IaCM, scoped at the workspace (and ideally pipeline/org/project) level, consistent with the existing CD freeze window model — so customers doing infra/delegate maintenance can block plan/apply execution for a defined time range without custom OPA policies or manual gating.

Currently Harness STO supports deduplication for the issues present in the same scanner report, but if we are scanning the same code with multiple scanners, it is not deduplicating it. Please add support for it as it is critical for us and we can't rely on the report from a single scanner.

We want to remove the specific value "For All Time" field for the "how long?" field. Ideally, being able to customize the values in the drop down would be the goal. Specifically, we want to remove For All Time, because the developers want to submit exemptions with the max time, but there are no reasons why we would allow a "for All Time" value. It doesn't appear that OPA allows us to control value or control the submission routine. This causes problems for us because it adds unnecessary delays when people submit a request for "For All Time"

As an administrator of Harness CCM I want to limit who can ignore an Asset Governance Rule or a whole Azure subscription so that enterprise-wide governance over resources is maintained. Currently any end user can select to ignore a recommendation and when the dialog opens they are given the opportunity to ignore the rule (ie no more recommendations are generated by the rule) or ignore the subscription (ie all of the resources fulfilling the rule criteria in a subscription will no longer be governed by the rule) or ignore the Resource that this recommendation was about. We only want the last option to be available to the end User. Please remove the options or place them behind a feature flag.

Goal is to implement Checksum validation in CI for already executed changesets. DBSchema Test and Preview in CI using DBSchema/dbinstance is counted against resource constraint which in turn blocks CD using same DBSchema/dbinstance. Feature Request is to have lockfree/resource constraint free native method to perform checksum validation in CI

Description: The Harness IACM Module Registry provides an automated Onboarding Pipeline capability, which allows platform teams to automatically generate testing, validation, and publishing pipelines when adding new IaC modules. However, the Provider Registry currently lacks this functionality, requiring engineers to manually build, configure, and maintain individual pipeline definitions to publish and validate custom or private IaC providers. We request native support for Default Onboarding Pipelines within the IACM Provider Registry. Adding a new cloud or infrastructure provider should trigger or allow auto-generation of a standard onboarding pipeline to handle security scanning, binary validation, documentation compilation, and version publishing. Business Impact: Operational Efficiency: Streamlines the onboarding process for custom and private providers, eliminating repetitive manual pipeline construction by platform engineers. Standardized Security & Compliance: Guarantees that every provider published to the internal registry undergoes automated security checks, signature verifications, and compliance scans before availability. Feature Parity: Delivers consistency across registry workflows in the IACM platform by aligning Provider Registry governance directly with existing Module Registry capabilities.