Anatomy of a finding

A finding is the unit everything else hangs off. This is what is on one, and how to read it.

Identity

idstringrequired

Identifies this finding within the scan that produced it. A rescan produces new ids, so list again rather than reusing them.

titlestringrequired

One line saying what is wrong. Written to be read in a list.

rulestring

The rule that produced it, such as SSRF-001. Finer than the category, and stable across scans.

categoryenum

code, dependency, secret, misconfig, or os-package. Decides which check produced it and what --category filters on.

Judgement

severityenumrequired

critical, high, medium, or low on the wire. Displayed as Critical, High, Watch, and Info.

severityLabelstring

What to show a person. Filter on severity, report severityLabel, and do not mix them up.

confidencenumber

0 to 1, derived from what validation could verify. Absent on findings where the notion does not apply.

stateenum

The scanner's own verdict: CONFIRMED, LIKELY, and the rest. Distinct from your triage decision.

Location

filestringrequired

Path relative to the repository root.

linenumber

First line of the vulnerable region.

endLinenumber

Last line, when the region spans more than one.

symbolstring

The enclosing function. Part of how a finding survives the file being reformatted.

codestring

The vulnerable source itself, so you can judge it without opening the file.

Evidence

dataflow.sourceenum

Where untrusted input enters, such as HTTP_QUERY_PARAMETER or FILE_UPLOAD.

dataflow.sinkenum

The dangerous operation it reaches, such as SHELL_COMMAND or OUTBOUND_HTTP_REQUEST.

dataflow.stepsarray

The path between them, each step with its role, file, and line.

dataflow.ineffectiveSanitizersarray

Guards on the path that look protective and do not defend this sink. Usually the most interesting field on the finding.

researcharray

The public security research this finding matched, with the rationale and the references. Present on matched findings.

References and remediation

cvestring

The CVE, on dependency and OS package findings.

cwestring

The weakness class, such as CWE-918.

descriptionstringrequired

What is wrong and why it is dangerous, in this repository's terms.

guidancestring

How to fix it, written for the code in front of you rather than in general.

fixobject

The generated patch, if one exists, and its state. See How fixes are written.

What the workspace shows on one finding

Opening a finding gives you the same fields laid out to be read rather than parsed, and two things worth going to the workspace for.

• The captured code. The vulnerable region as it stood at the commit that was scanned, with real line numbers and the flagged lines marked, headed with the file and the line range it covers. It is captured rather than fetched, so it is the code the finding is actually about even after the branch has moved on.
• The path from the entry point to the dangerous call, step by step with its file and line, which is what lets you judge reachability instead of taking the verdict on trust.
• The verdict and its confidence, the commit that introduced it, and the research that matched, each with why it matched and a link out to the source.

Reading one

cf reproduced show <finding-id>
cf reproduced show <finding-id> --json
cf reproduced show <finding-id> --web

The listing carries the summary fields. The detail view adds the code, the flow, the research, and the patch, and pages when it does not fit your terminal. --web opens the file on your provider instead of printing anything. Read the detail before forming an opinion about a finding: the list is not evidence.