Skip to main content
A finding is a security issue in your code or environment. Findings come from security hunts, your own workflows, and PR review. You review them in Risk.
The Findings tab on the Risk page, listing findings with their repository, file, and severity

​
How a finding is confirmed

Before a finding shows as confirmed, Enclave:
  1. Deduplicates it against your existing findings.
  2. Verifies it with an independent agent that reads the code beyond the reported files.
  3. Assesses exploitability against your environment, to see whether an attacker can reach it.

​
The Risk page

Filter by State, Severity, or Exploitability, or search by text. Filters are saved in the URL, so you can share a view.

​
What a finding contains

A finding page showing the vulnerability summary, affected files, exploitability, and affected assets
  • Summary: what the flaw is, where it is, and what an attacker gains.
  • Proof of concept: how it was demonstrated, so you can reproduce it.
  • Attack path: the chain from entry point to the flaw, when exploitability is confirmed.
  • Exploitability: whether the flaw is reachable in your environment, and why.
  • Affected assets: the services and cloud resources involved.
Click Export PDF to download a report, or Copy as markdown to paste it into a ticket.

​
Exploitability

​
Severity

Severity can change when Enclave learns more about where the code runs.

​
Statuses

To change a status, open a row’s ⋯ menu, or click the status on the finding’s page. Every change is recorded with who made it.

​
Triage from Research

Ask Research to work your queue in plain language, for example:
  • Dismiss every low-severity finding in legacy-admin
  • Mark the three SSRF findings in payments-api as resolved
  • Update the proof of concept for this finding with the steps we just ran
Research shows an approval card before it changes anything. One approval covers up to 100 findings. To point at specific findings, paste their links or attach them with Add context.

​
A weekly routine

  1. Open Active risks and start with Critical and High.
  2. Mark what isn’t real Inactive, and what you won’t fix Dismissed.
  3. Hand the rest to the owning team, and mark them Resolved when the fix ships.
  4. Ask Research: Which findings still need evidence, and what would verify them?