The workspace

The workspace at cefense.com/app is the visual half of Cefense. Everything in it is also available from the CLI, and neither is a cut-down version of the other.

Layout

The sidebar selects the repository queue, history, coverage, and triage views. Across the top, Findings, Research, Fixes, and Verification keep the selected repository and report in context. Selecting a finding opens its evidence alongside the queue.

The main destinations

Findings

The queue of reported issues and maintainability observations for the selected repository and report. Search, filter, and open a row to inspect its evidence.

Research

Related security context and any recorded source path. Research context is distinct from a confirmed exploit.

Fixes

Review proposed patches, copy a fix prompt for your own coding agent, or prepare eligible fixes together. Preparation does not apply changes to your provider. Review the delivery requirements before opening a draft pull request.

Verification

Review recorded proof runs and their tested scope. Starting a new hosted run has its own plan, allowance, and execution requirements.

Commits

The scanned commit history, with what each commit introduced and resolved. See Branches and commits.

Repository coverage

The recorded checks and named threats for the selected repository, including what was not tested. Separate research advisories provide additional context.

Sources

Images

The container images connected from a registry, each with its latest scan and what that scan found in the operating system packages inside it. On Pro and Max. See Container images.

Triage

Flagged

What you have marked as worth coming back to.

Dismissed

What you ruled out, as a false positive or as an accepted risk, with the reason you gave.

Completed

What a later scan no longer reproduces.

These three split the queue by what you have decided about it, so Findings stays a working queue instead of turning into an archive. See Triage and Triaging from the terminal.

Validation

Audit log

Every consequential action, filterable by category, actor, and time. The same record cf audit reads.

Repository coverage

Repository coverage lists one row per threat, such as SQL injection, committed secrets, or cross-user data access, and says where the selected repository stands on each. It reads the repository's latest completed scan, so it changes when a scan finishes. Opening a row shows the findings behind it, how it is tested, the research linked to it, and its state over recent scans.

Basic

Pattern rules, dependency advisories, and secret scanning, plus infrastructure misconfiguration checks. The checks a scan already runs.

Advanced

The model pass, for flaws no pattern rule catches, such as missing authorization or cross-user data access.

Hyper

The attack executed in the proof sandbox, rather than read from the code. Hyper is on Max. On other plans its rows are shown locked.

Each threat has one of five states on each repository:

Exposed

At least one finding in the latest scan is this threat. The row says how many, and where the first one is.

Closed

It was exposed before and is not now, and a merged fix or a proof closed it.

Clean

The test ran and found nothing.

Not tested

The test did not run, and the row says why: the check that runs it is turned off, the scan did not reach everything, or, for Hyper, the sandbox has not executed the attack.

Does not apply

The threat needs something this repository does not have, such as a framework that is not in its dependencies. These rows are collapsed under each tier.

A Hyper row is only exposed or closed when the sandbox actually executed the attack. When it only reasoned about it, or has not run yet, the row stays not tested.

Immunity Watch

Immunity Watch is on Max. When new research names an affected package, Watch checks it against the packages the repository's last scan recorded, without starting a new scan, and records one verdict: reaches, when an affected version is there; does not reach, when it is not; unknown, when the recorded version cannot be decided against the affected range. It is only as current as that last scan.

Watch is separate from the advisory email, which is sent when a CVE is published against a package one of your scans recorded. See Email notifications.

Settings

A repository's settings open from the repository switcher and cover when it is scanned, how deep each scan looks, which checks run, and the SBOM exports, the same things cf settings covers. They are an owner or admin decision, and a member sees them read-only with a line saying so. See Scan triggers, Scan depth, and Checks.

Plan and usage

The account menu opens Plan and usage: the organization's plan, its seats, how much of the allowance this period has spent, and what it would cost to change any of it. Anyone can read it, and only an owner or admin can change it. See Plans and billing and Usage and limits.

The audit log

Every consequential action is recorded: who started a scan, who dismissed a finding and with what reason, who published or merged a fix, what settings changed and when. The Audit log view filters that record by category, actor, and time, and the same record is readable from the terminal with cf audit.

Switching repository and branch

The workspace acts on one repository at a time, and shows the findings of that repository's most recent scan. Switching branch switches to that branch's own last scan, which is why a branch that has never been scanned has nothing to show until you scan it.

Doing the same from the terminal

What is not finished yet