Some changes take longer to deliver safely into production. Sometimes teams have shifting priorities. Sometimes we all log off for the holidays. Whatever the reason, we don’t want to leave remediation work open for an extended period without explanation.
If you cannot merge an eligible remediation pull or merge request before its grace period ends, you can submit a Snooze Request. Approval creates a time-bound Exception; it does not remove the policy or close the underlying work.
Submit a Snooze Request
Section titled “Submit a Snooze Request”You can submit a Snooze Request directly in the comments on your pull or merge request.
Post one of these commands as a comment on the remediation pull or merge request:
/snooze 4d "Waiting for the upstream module release"/snooze 2w "Compatibility testing needs another sprint"/snooze 2026-08-31 "Migration completes at the end of August"Durations use d for days or w for weeks. An absolute date uses
YYYY-MM-DD. The requested end must be in the future, no more than 90 days
away, and at least as late as the repository’s next active routine date.
A reason is required. This must be provided in quotation marks. The reason provides the security reviewer with important context about your team that they would not otherwise have access to. The reviewer can make an informed decision about the risk of a delayed base image update.
BIMP will relay the decision to approve or deny the snooze request alongside any comments or questions from the security reviewer as another comment on the pull or merge request.
If BIMP rejects the command, read its reply. Correct the duration, date, reason, or routine coverage and submit a new valid command.
Review and approve a request
Section titled “Review and approve a request”Open Tasks and select the Snooze request. Review:
- repository, branch, and artifact;
- remediation pull or merge request;
- From image and To image
- requester, reason, and requested expiry;
The requester cannot approve their own human-submitted request. Only users with Exception-review authority can approve or deny Snooze Requests. Owners and Security Administrators have the intended built-in authority.
Choose:
- Approve to create an Exception through the requested expiry;
- Deny to reject the request with a review note; or
- Cancel when the requester withdraws an open request.
BIMP posts the decision back to the requester as a comment on the pull or merge request. If the Snooze Request is approved the pull or merge request is placed in draft status, if it denied the pull or merge request stays open.
Understand the lifecycle
Section titled “Understand the lifecycle”| State | Meaning |
|---|---|
| Open | The Snooze Request is awaiting a decision. |
| Approved | A time-bound Exception currently applies. |
| Denied | The reviewer declined the request. |
| Cancelled | The request was withdrawn or its remediation completed first. |
| Revoked | An approved Exception ended before expiry. |
| Expired | The approved time window ended. |
An authorized reviewer can reopen an eligible request when another decision is needed. Revocation records why the approval no longer applies. These actions add lifecycle evidence instead of editing earlier decisions.
If the linked remediation is merged or closed before approval, BIMP cancels the pending task because it is no longer required.
How an Exception affects policy
Section titled “How an Exception affects policy”An open review can place an affected artifact into Review state. An approved Exception will place it into Exception state until expiry or revocation.
The published mapping remains in force. After the Exception ends, BIMP evaluates the current repository reference against the current published policy again.
Notify reviewers
Section titled “Notify reviewers”A security reviewer does not want to login to BIMP every day to find out if they have a new task to review. We recommend creating a notification in your existing tooling when a new task is created and you have a new action.
Create a webhook destination and select the public Snooze Request events. A generic signed webhook or Slack destination can notify your reviewers immediately when a new snooze request is received.
Email is not currently a webhook type. Use a generic webhook to connect an email service if your organization operates one.
For setup, see Create a webhook.