`--severity-threshold` is ignored

[igor-sosnowicz]

Withe the following command
vulnapi scan curl -X 'POST'
'http://127.0.0.1:8000/register'
-H 'accept: application/json'
-H 'Content-Type: application/json'
-d '{
"first_name": "string",
"last_name": "string",
"email": "string@gmail.com",
"password": "string",
"role": "candidate"
}' --report-format table --severity-threshold 7.0

...

OPERATION	RISK LEVEL	CVSS 4.0 SCORE	OWASP	ISSUE
POST /register	Medium	5.1	API8:2023 Security	CORS Headers are missing
			Misconfiguration
	Medium	5.1	API8:2023 Security	CSP frame-ancestors policy is
			Misconfiguration	not set
	Medium	5.1	API8:2023 Security	X-Frame-Options Header is
			Misconfiguration	missing
	Info	0.0	API8:2023 Security	Service Fingerprinting
			Misconfiguration
	Info	0.0	API8:2023 Security	Operation May Accepts
			Misconfiguration	Unauthenticated Requests
	Info	0.0	API8:2023 Security	X-Content-Type-Options Header
			Misconfiguration	is missing
	Info	0.0	API8:2023 Security	CSP Header is not set
			Misconfiguration
	Info	0.0	API8:2023 Security	HSTS Header is missing
			Misconfiguration

I should have received issue with the severity level >= 7.0, but I get all of them.

Thank you for your efforts in advance!

[emmanuelgautier]

You're correct in observing that the --severity-threshold option does not currently filter the results shown in the report.

Instead, it's designed to trigger stderr exit code (stderr) if any vulnerability is found with a severity equal to or higher than the threshold. This allows the CLI to be integrated into CI/CD pipelines, where you may want to fail a build if certain severity levels are detected.

That said, you're absolutely right, the ability to filter and report only issues above a certain severity threshold is currently missing from the CLI. This is definitely a useful feature, and I’m actively working on implementing it.

Appreciate your feedback! Stay tuned for updates, and feel free to suggest any other improvements you'd like to see.

[github-actions]

Hello contributors!

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.
If you believe this issue is still relevant, please comment with your thoughts or re-open it.

Thank you for your contributions! 🙏