Findings and policy
Findings and severity
What a finding is, what each severity means, and where to find them.
A finding is one security problem reported by one scan. Findings belong to their scan. If two scans report the same problem, each has its own finding, so every report stands on its own.
Severity
| Severity | Typical example | Suggested action |
|---|---|---|
| Critical | Anyone on the internet can read or change other users' data, or run code on your server. | Fix before merging. |
| High | A signed-in user can reach data or actions they shouldn't, or a secret is exposed. | Fix before merging. |
| Medium | A weakness that needs other conditions to exploit, such as no rate limit on a sensitive action. | Fix soon. |
| Low | A hardening gap, such as an error message that reveals internal details. | Fix when convenient. |
Your blocking policy decides which severities stop a commit or a merge.
Find scans and findings
Go to Scans for every scan you can access. Filter by:
- Scan type: pre-commit or pull requests
- Severity, Status, Repository, and date range
- who ran it: Mine or everyone
Sort by Most findings to see the scans that need attention first. Open a scan for its findings, then open a finding for its location, description, impact, and fix.
Copy Finding copies one finding as Markdown, ready for a ticket or for your coding agent.
When a finding is wrong
- If it isn't a real problem, mark it as a false positive.
- If scans keep reporting something intentional, add a scan exception.
Still stuck after reading this page?