Reading findings | Cefense docs

cf reproduced lists findings in your code. cf matched lists the subset joined to public research. These docs use those names consistently with the workspace and agent examples. The documented aliases are cf finding list and cf finding matched; inspect your installed command schema before relying on an alias or flag.

Listing

Listbash

cf reproduced
cf reproduced --severity critical,high
cf matched
cf reproduced --category dependency --limit 20

Findings arrive worst first. Run against a large repository, start narrow with --severity critical,high and widen from there: a whole-repository listing is the biggest payload the CLI produces.

Filters

Flag	Values	Notes
`--severity <list>`	`critical`, `high`, `watch`, `info`	`medium` and `low` are accepted too. Comma separated.
`--category <list>`	`code`, `dependency`, `secret`, `misconfig`, `os-package`	Comma separated.
`--branch <name>`	a branch name	Reads that branch's last scan.
`--scan <id>`	a scan id	Reads one scan directly.
`--limit <n>`	1 to 1000	Maximum findings to fetch.
`--matched`	flag	On `cf reproduced`: only findings joined to research.
`--exit-code`	flag	Exit 1 when any Critical or High finding is present.

Displayed	Wire value	`--severity` accepts
Critical	`critical`	`critical`
High	`high`	`high`
Watch	`medium`	`watch`, `medium`
Info	`low`	`info`, `low`

Which scan you are reading

Without --branch or --scan, you get the newest scan of the repository, whichever branch it ran on. Naming a branch that has never been scanned fails with branch_not_scanned rather than quietly falling back.

Reach and status

Two columns sit beside each finding. reach says whether the vulnerable code can actually run here: reachable (a path runs from an entry point to it), imported (it is used, but nothing was found that reaches it), dev-only (only tests and tooling reach it), unimported (nothing uses it), or unknown (not measured). status is the same word as the status ring in the workspace: no patch yet, in progress, patch ready, proven, pull request open, merged, refuted, or need review.

Opening one finding

In fullbash

cf reproduced show <finding-id>
cf reproduced show <finding-id> --branch release/2.4

The detail view adds the vulnerable code, the package and the version that fixes it for a dependency, why the code is or is not reachable, the data flow from source to sink, the research that matched with its rationale, the references, the status of its patch and proof, and the patch if one exists. Read it before forming an opinion: the listing is a summary, not evidence. See Anatomy of a finding.

Piping and scripting

Three output modesbash

cf reproduced | grep critical
cf reproduced --json | jq -r '.findings[] | select(.severity == "critical") | .filePath'
cf reproduced --agent

Piped, the output is tab separated lines. --json is the raw API response, pretty printed. --agent is the stable machine envelope. See JSON output.

Failing a build on findings

Exit 1 on Critical or Highbash

cf reproduced --severity critical,high --exit-code

Use --exit-code rather than matching on output text. See Running in CI.

Triaging from the terminalRecording what you decided, with the reason.Applying fixesWhen the answer is a patch rather than a decision.Reading the outputColumns, grouping, the pager, and where the CLI asks.

Have a correction or need help?

Email the docs team