.bundler-audit.yml

ignore:
  - CVE-2024-0227
  # devise-two-factor - CVE-2024-0227
  # Mitigated per https://github.com/devise-two-factor/devise-two-factor/security/advisories/GHSA-chcr-x7hc-8fp8 by:
  #   Use the lockable strategy from Devise to lock a user after a certain number of failed login attempts. See 
  #   https://www.rubydoc.info/github/heartcombo/devise/main/Devise/Models/Lockable for more information.

  - CVE-2024-8796
  # devise-two-factor - CVE-2024-8796
  # Mitigated per https://github.com/devise-two-factor/devise-two-factor/security/advisories/GHSA-qjxf-mc72-wjr2 by:
  #   Setting the default value for otp_secret_length to 26 in the Devise config iniitializer.