Graduated security & compliance rules now gate by default

title: "Graduated security & compliance rules now gate by default" description: "Twenty OWASP, SOC 2, PCI, and HIPAA rules that cleared our quality bar now block commits by default on paid plans — with a one-click per-project opt-out." date: "2026-08-05" author: "The CommitMind team"

CommitMind's paid security packs (OWASP, SOC 2, PCI, HIPAA) have always surfaced findings. Until now, most of those rules were advisory — they showed up in review but didn't block a commit unless you promoted them yourself, per project. That's changing for the rules we can stand behind.

What's changing

Twenty security & compliance rules that cleared our measured quality band now gate commits by default for organizations on a paid plan with the blocking gate enabled. A real, high-confidence finding from one of these rules will block the commit instead of only warning.

The twenty are the OWASP, SOC 2, PCI, and HIPAA rules that passed our offline benchmark at precision ≥ 0.85 and recall ≥ 0.50 over ≥ 6 cases — the bar we set so a rule only gates when a false block is genuinely rare. Precision is the load-bearing number here: we would rather miss than cry wolf on a paid gate.

What is not changing:

• Free plans are unaffected — every finding stays advisory; nothing blocks.
• Code-quality/architecture rules stay advisory (SRP, DIP, and friends). Blocking a commit over a design opinion is not something we'll do by default, even when the rule is accurate.
• Rules that didn't clear the bar stay advisory. One OWASP rule (A01 mass-assignment) missed on precision and remains advisory until its corpus improves.

The safety valve: per-project opt-out

Because this flips some commits from "passed" to "blocked," every graduated rule carries a per-project opt-out. If a rule doesn't fit your codebase, an org admin can demote it back to advisory in one click:

Dashboard → Rules → open the rule → the rule shows a "Gates by default" badge and an "Opt out (advisory)" button. Opting out is instant, reversible ("Restore gating"), and scoped to that one project. It's the immediate escape hatch — no --no-review, no config file.

What you should do

• Nothing, if the defaults work for you — the point is that they should.
• If a specific gate is noisy for your project, opt it out from the rule's page. You keep the finding as advisory; you just don't get blocked.
• Watch for one edge case: the SOC 2 CC7.2 audit-logging rule clears the bar at the recall floor, so it's the most likely to be chatty. It's the first we'll demote if we see drift — and the opt-out is right there if you hit it first.

This rolls out with the release that seeds the graduated set. As always, the changelog has the full list, and you can review or adjust any gate from the Rules page.