Docs
Findings
Severity, triage, keyboard shortcuts, and AI explanations with fixes.
Severity and source
Findings have one of five severities: critical, high, medium, low and info. Lists show the most severe first.
Each finding says where it came from: one of the four scanners, or the swarm. Swarm findings are verified, and arrive with their evidence from source to sink and a patch. Findings are mapped to CWE and, where they apply, to the OWASP Top 10 for LLM Applications and for Agentic Applications.
Finding the ones that matter
Filter by repository, severity, status, type and source, or search. The filters live in the page's address, so a view can be bookmarked and shared. Findings from pull requests are kept apart from the default branch's.
Triage
| Status | Meaning |
|---|---|
| Open | Needs a look. New findings start here. |
| Fixed | The latest full scan of the default branch no longer sees it. |
| Ignored | Real, but you decided not to fix it. Needs a reason. |
| False positive | Not a real issue. Needs a reason. |
Members and above triage. Select several findings to change up to 500 at once. Reasons are kept in the finding's history, and later scans never reopen a finding you ignored or marked as a false positive.
Keyboard
On the findings list:
| Key | Does |
|---|---|
| j | Next finding |
| k | Previous finding |
| x | Select or unselect |
| Enter | Open |
| i | Ignore (the selection, or the current finding) |
| f | Mark false positive |
| e | Explain and fix |
| ? | Show these shortcuts |
Explain and fix
AI reads the code around a finding and returns an explanation, how likely the finding is a false positive and why, and a fix. When there is no safe automatic fix, it says so rather than guessing.
| Finding | Fix |
|---|---|
| Code and infrastructure | A minimal patch, checked to apply to the file and to parse after it applies |
| Dependencies | The version bump, with notes on what the upgrade might break |
| Secrets | Steps to rotate the secret; no patch |
- Automatically for new critical and high findings, while your organization can use AI (a paid plan, or trial credits). On Team and Enterprise, admins choose the severities or turn it off under Settings, Policies.
- On demand: members and above use Explain and fix on any scanner finding (e on the list).
Each explanation uses a few credits, charged for what it actually costs. A finding whose code hasn't changed in the 30 days since its last explanation is answered from cache at no cost. For secrets, only the redacted line is sent, never the file.
How long findings are kept
Open findings stay until they are fixed. Fixed, ignored and false-positive findings are deleted after your plan's retention period: 90 days on Free, 365 days on Pro, 365 days on Team. Pull request findings are deleted 30 days after the pull request's last scan.