missing_csrf_protection

Re-enable CSRF protection or document the exemption low effort

// Express (csurf, legacy)
const csrf = require("csurf");
app.use(csrf({ cookie: true }));

// Express (csrf-csrf, modern)
const { doubleCsrf } = require("csrf-csrf");
const { doubleCsrfProtection } = doubleCsrf({ getSecret: () => secret });
app.use(doubleCsrfProtection);

// Spring Security
http.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());

// Django — remove @csrf_exempt
def my_view(request): ...  # no decorator = protected

// Flask — re-enable WTF
app.config["WTF_CSRF_ENABLED"] = True

// Rails — restore protect_from_forgery
class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

Document the API-only exception — don't silently suppress trivial effort

// .driftrc.yml
analyzers:
  builtin/csrf:
    enabled: false  # JWT-only API; CODEOWNERS reviewed 2026-Q2

Suppress a confirmed non-issue with a committed .pullguardignore entry (pullguard ignore locally, or comment /pullguard ignore <fingerprint> <reason> on the PR — the fingerprint is printed in the PR comment’s Triage section). Entries support expiresAt for time-boxed snoozes.

Security findings at major or critical severity — and any critical finding — always surface: .pullguardignore cannot hide them. The reviewed paths that keep them visible are acknowledged (reviewed, stays in reports) and, for a confirmed false positive, a reasoned false_positive entry — visible and audited, excluded only from the merge block.