DefectDojo
api-importer write-only role for uploads
Is your feature request related to a problem? Please describe Currently, the api-importer role is too permissive really, as it allows reading sensitive information, even though it could be leaked in a CI/CD pipeline environment.
Describe the solution you'd like We're lacking a permission for uploading scan reports or creating findings. It should be used in a new write-only api-importer role, so that the token cannot ever be used to leak information, but only add to the Defectdojo findings.
Describe alternatives you've considered
No other way of doing that, tried creating a user without any role, but the "Configuration Permissions" table with checkboxes doesn't have an option for "Add" findings or engagement etc...
