SAST + Secrets Detection jobs don't fail - even with vulnerabilities

I have a pipeline with tests for SAST + Secrets on code that has vulnerabilities. Those jobs ‘pass’ even with vulnerabilities found. This appears to be the default behavior. Is there a way to force failure on detection? I see some old (2021) posts here about parsing the generated artifacts to cause failure, but that doesn’t seem like a good solution.