Pre-commit scans
Read a scan report
Understand what a scan found and decide what to do with each finding.
Every scan produces a report: a list of findings, each one a single security problem in your change. You can read it in three places:
| Where | What you get |
|---|---|
| Terminal | A count and a breakdown by severity. |
.git/lighthouse/findings/<scan-id>.md | The full report in Markdown. It's inside .git, so it's never committed. |
| Dashboard | Open the view link, or find the scan under Scans. |
Parts of a finding
| Part | Meaning |
|---|---|
| Severity | How serious it is if exploited: critical, high, medium, or low. |
| Title | The problem in a few words, such as "Invoice export skips the owner check". |
| Location | The file and line. In the dashboard, it links to the code on GitHub. |
| Description | What's wrong and how it could be abused. |
| Impact | What an attacker could do. |
| Fix | How to change the code. |
Many findings also name a CWE, such as CWE-89 for SQL injection.
What to do with a finding
- Fix it. Change the code, stage it, and commit again.
- If it isn't a real problem, ask an admin or the repository's maintainer to mark it as a false positive. It stops counting.
- If scans keep reporting something intentional, add a scan exception so they stop.
The scan page
Open a scan in the dashboard to see its outcome (passed or Blocked), the number of files reviewed, its depth, and every finding in full. Copy markdown and Download export the report for a ticket or a pull request description.
Still stuck after reading this page?