Skip to content

Z614: UNAPPROVED_DOMAIN_REFERENCE

  • Severity: Error

    Penalty: 0.0 points | Category: general

  • Remediation & Opt-In

    Auto-Fixable: No | Opt-In: No

Description

An external link references a domain name that is not included in the Zero-Trust allowed external domains whitelist ([policies].allowed_external_domains).

The Policy-as-Code Engine provides Zero-Trust domain governance. When allowed_external_domains is populated, Zenzic enforces an explicit positive whitelist. ANY link pointing to a domain not present in the whitelist triggers a Z614 finding.

Z614 is an error severity finding (Penalty: 5.0 pts) because referencing unapproved third-party domains exposes users to unvetted external dependencies and potential domain takeover risks.

How to Fix

Either update the external link to point to an approved domain, or add the domain to the whitelist in .zenzic.toml if it is verified and trusted.

Before (non-compliant when allowed_external_domains = ["zenzic.dev"]):

# Resources

Check out [unvetted domain](https://unapproved.example.org/spec).

After (compliant):

# Resources

Check out [official docs](https://zenzic.dev/docs).

Configuration

Z614 is opt-in and inactive by default. It is enabled by populating allowed_external_domains under [policies] in .zenzic.toml:

[policies]
allowed_external_domains = [
    "zenzic.dev",
    "github.com",
]

When allowed_external_domains is empty or absent, no Z614 findings are emitted.

Suppression

If an unapproved external link is required in a specific document, suppress the finding inline:

<!-- zenzic:ignore:Z614 -->
[External Spec](https://unapproved.example.org/spec)

Or use [governance].per_file_ignores in .zenzic.toml:

[governance.per_file_ignores]
"docs/legacy/**" = ["Z614"]

Reference

See the Finding Codes Index for finding code details.