Security findings

The Security area collects the vulnerability scans and secret detections for a repository. From it you can trigger a scan, read the results of a completed scan, browse a deduplicated Findings list that collapses repeat detections across every scan, and dismiss findings you have reviewed. Findings are grouped by severity and by the kind of scanner that produced them, and each one links back to the commit it was found on.

Where to find it

• URL: gitvetrix.com/<owner>/<repo>/security. The deduplicated findings list is at gitvetrix.com/<owner>/<repo>/security/findings.
• Navigation: open a repository and select Security in the side navigation. The Security entry appears only if you have write access to the repository; without it, the page shows a message that you do not have permission to view security findings.

The Security overview opens on two tabs, Scans and Secret Alerts, with a link at the top to Open Findings for the deduplicated view.

Trigger a scan

1. On the Security overview, stay on the Scans tab.
2. Select Run scan. If the button is disabled with a tooltip noting no scanners are enabled, an instance administrator must enable a scanner first.
3. In the Trigger security scan dialog, choose a Scan type. The available types are SCA, SAST, Secrets, and Container; a type that is not enabled on the instance appears marked unavailable and cannot be picked.
4. Optionally enter a Commit SHA to scan a specific commit. Leave it blank to scan the latest commit.
5. Select Run scan to queue the scan. A running or pending scan refreshes on its own until it finishes.

If the scan cannot be queued, the dialog stays open and shows the reason so you can correct the input and select Retry.

Read the scans list

The Scans tab lists every scan that has run, one row each:

• Scan type — SCA, SAST, Secrets, or Container.
• Tool — the scanner that ran.
• Commit — the commit that was scanned; select it to open the commit.
• State — Pending, Running, Completed, or Failed.
• Critical, High, Medium, Low — the count of findings at each severity, or a dash when there are none.
• Date — when the scan ran.
• Actions — a View link on a Completed scan that opens its detail.

A repository with no scans shows No scans yet.

Read a scan's findings

1. On the Scans tab, select View on a Completed scan.
2. On the Scan detail page, read the severity summary bar at the top, which counts the active findings under Critical, High, Medium, Low, and Info.
3. Below it, read the scan's Tool, Commit, and completion time.
4. Read the table of findings, sorted with the most severe first. Each row shows:
   • Severity — Critical, High, Medium, Low, or Info.
   • CVE ID — the advisory identifier, when one applies.
   • Package — the affected package.
   • Installed — the version in your repository.
   • Fixed — the version that resolves the finding, when one is known.
   • Location — where the finding was reported.
   • Actions — a Dismiss control.

When a scan has dismissed findings, a Show dismissed control appears; select it to include them (greyed out) and Hide dismissed to remove them again. A scan with nothing active shows No active findings.

Browse the deduplicated Findings list

The Findings list shows one row per unique finding, collapsed across every scan that reported it, so a vulnerability seen on many commits appears once.

1. From the Security overview, select Open Findings, or go to gitvetrix.com/<owner>/<repo>/security/findings.
2. Read the table. Each row shows the finding's severity, its category, its Rule / Location, a Count of how many times it has been seen, and when it was Last seen. A dismissed finding is marked (dismissed).
3. Narrow the list with the filter bar:
   • Filter by severity (critical, high, medium, low, info).
   • Filter by category (sca, sast, secrets, container).
   • Set State to Detected, Dismissed, or All.
   • Select Clear filters to reset.
4. Select a row to open its Finding detail drawer, which shows the severity and category, the number of occurrences, the rule or location, and an Occurrence log. The log lists each scan that saw the finding, its commit, whether it was Detected or Dismissed there, and who dismissed it and why.

The filters are kept in the page address, so you can copy the URL to share the exact view. A Secret Alerts link filters the list to secret detections. Export SARIF and Export CSV download the findings that match the current filters. When nothing matches, the list shows No findings match the current filters.

Dismiss a finding

Dismissing hides a reviewed finding from the active list until the scanner reports it again.

1. Find the finding, either on a scan's detail page or in the Findings list.
2. Select Dismiss. To dismiss several at once from the Findings list, select their checkboxes and choose the Dismiss button that appears with the count.
3. In the confirmation dialog, enter a Reason. The confirm button stays unavailable until you provide one.
4. Confirm to dismiss. The reason is recorded against the finding and shown in its occurrence history.

The checkboxes and bulk-dismiss control appear only if you are allowed to dismiss findings in this repository.

Manage secret alerts

The Secret Alerts tab lists credentials detected in the repository's history:

• Pattern — the kind of secret that matched.
• File — the file it was found in; select it to open the file at that line.
• Line — the line number.
• Commit — the commit it was detected on.
• Detected — when it was found.
• Actions — a Dismiss control that opens the reason dialog.

When there are none, the tab shows No active secret alerts.

Related pages

• Code coverage — the coverage results reported by a pipeline run, alongside security in the CI/CD area.
• Security — the instance-wide vulnerability summary and default merge and deploy policy an administrator manages.