What are the severity levels?

Critical, High, Medium, Low, and Info. Info items and passed checks are listed separately in reports as Passed Checks rather than as issues, and they do not affect the risk score.

How do I mark something as a false positive?

Open the finding and choose False positive from the status menu. It is excluded from the risk score and from future deduplication. If you think detection itself is wrong, also use Report inaccuracy on the scan so the team can tune it.

What is the difference between Ignore and False positive?

False positive is a status stored on the finding and shared with your team. Ignore is a browser-local hide for that domain — it only affects your own view and can be restored any time.

Findings: Severity, Evidence & Fixes

Where findings live

Scan page → Findings tab — everything from one scan, grouped by severity.
Findings — every finding across all targets, filterable by domain, severity, and status, with a cross-finding AI chat.
Feed — a triage inbox with severity counts, “new in last 7 days”, “solved in last 7 days”, quick filters (Quick Fixes, SLA Due Soon, Out of SLA, Recently Discovered), and Snooze / Ignore / Mark solved actions. Snoozed, ignored, and solved items have their own sub-views.

Anatomy of a finding

Field	What it holds
Title	Short, specific name, e.g. Supabase table exposed without RLS.
Severity	`critical`, `high`, `medium`, `low`, `info`.
CVSS	Base score 0–10.
CWE	Weakness class, linked to cwe.mitre.org.
OWASP	Top 10 category, linked to the OWASP page.
Description	What was found and why it matters.
Evidence	The captured HTTP request and HTTP response that demonstrated the issue.
Remediation	Numbered steps to fix.
Code fix	Side-by-side Before (vulnerable) / After (fixed) snippet in the detected language, when a patch can be shown.
Related findings	Other findings on the same target that share a root cause.
Status	`open`, `confirmed`, `false-positive`, `fixed`.

Findings are deduplicated per organization, target, and title, so a re-run does not create a second copy of the same issue — it updates the existing one and the trend shows it as unchanged, fixed, or new.

Severity and the risk score

Severity drives the risk score: Critical ×35, High ×20, Medium ×10, Low ×3, Info ×0, capped at 100. Full explanation on Risk score.

Actions on a finding

Retest — re-runs the single check that produced the finding to verify your fix. The finding shows Retest queued until the result lands.
Status — Mark fixed, False positive, or Re-open. Statuses are shared with your team and reflected in reports.
Ignore — hides the finding from this domain in your browser only. Ignored items collapse into an N ignored on this domain (local only) block with a Restore link.
Details — opens the finding on the Findings page with the full thread.
Ask about this finding — a per-finding AI chat that answers questions in the context of that finding’s evidence.

Preliminary findings

While a scan is in on-call review, findings that the reviewer has not yet confirmed carry a Preliminary badge. They can change or disappear once review completes; wait for the review email before opening tickets on them.

The AI fix prompt

Copy for LLM on the scan header and the Markdown export produce a report tuned for coding agents. Per finding, the fix prompt includes the app URL, severity and CVSS, CWE, OWASP, detected stack, what was found, evidence, how to fix, a reference patch, and a rules block that tells the agent to apply the smallest fix that fully resolves the issue without touching unrelated code.

Prompts are available in flavors for Lovable, Cursor, Claude Code, and a generic version. For Claude Code, run claude in the project repo and paste.

Passed checks

Checks that ran and found nothing are recorded as passed. They do not appear as issues in the app, but PDF and Markdown reports list them in a Passed Checks table so a reader can see what was covered, not just what failed.

FINDINGS