Begin with evidence
Check the scanner, rule, affected file and location, severity, description and remediation context. A finding represents a pattern or known issue detected by the configured scanner, not a complete proof of exploitability.
Know the coverage
Gitleaks detects secret patterns with redacted evidence. Trivy checks supported dependency, configuration and secret content. Neolyt's Semgrep rules cover selected JavaScript, TypeScript and Python code patterns. Check scanner completion and scope before interpreting a scan as clean.
- Scans do not run your application or inspect Git history.
- Dependency coverage depends on manifests, lockfiles and the available vulnerability database.
- A missing or failed scanner is a coverage limitation, not proof that its findings disappeared.
Separate explanation from result
Optional AI enrichment adds an explanation to existing scanner evidence. The configured provider receives bounded finding context, including redacted evidence and locations. This does not alter the severity, original finding or score, and it does not validate a fix.
AI processing boundaries →Choose the next action
For an eligible weak-hash pattern, review the targeted fix option. For secrets, rotate the credential. For dependencies, assess an upgrade. For an unsupported or ambiguous code finding, investigate and remediate manually.
- Acknowledging a finding is not fixing it.
- Ignoring a finding or marking a false positive changes its status; it is not a Verified Fixed result.
- After a code change, check a completed scan on the relevant commit.