Product guide · English
Work through findings
Review a finding’s evidence, track a concrete remediation task, and verify the result with a newer completed audit instead of treating a status change as a code fix.
Steps
- Start with Fix these first in the report. Its ranking highlights urgent evidence such as leaked secrets, malicious packages and known exploited vulnerabilities.
- Open Review and take action. Check the rule, source location, evidence, proposed remediation and confidence before changing code.
- Use Track this finding to add work, then assign an owner, priority and target date in Findings & work. Tracking follows the finding across audits.
- After the code change is available remotely, run a comparable audit and use Check the fix. Review the newer scan and its coverage; resolved work can reopen when the finding recurs.
Read the result
A suggested fix is review material, not proof of correctness. Distinguish an actual code fix from a suppression, accepted risk or approved policy exception. Keep the reason and relevant audit evidence with the work.
Limits and availability
Detection depends on the rule, selected checks and available source. Absence in a newer report is weaker evidence when the check did not run or scope changed. Never copy a raw credential into an issue or assistant prompt while discussing a secret finding.
This guide describes the implemented workflow. The features available in your workspace depend on account capabilities and configuration; advanced workflows are not all included in Free Quick Scan. Check the available controls and the evidence returned by each run.