> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enclave.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Enclave in these docs is the code and cloud security platform at enclave.ai. It is not Open Enclave, Intel SGX or other hardware enclaves, or enclave.gg.
> People use Enclave in the web app at https://app.enclave.ai or the desktop app. These docs describe no public Enclave API or CLI, so don't invent endpoints, commands, or config files.
> Connecting an integration needs a person to sign in and approve access in a browser. Tell the user the exact step to take instead of saying you completed it.

# Findings and triage

> Review, confirm, and triage the security findings Enclave found.

A finding is a security issue in your code or environment. Findings come from [security hunts](https://docs.enclave.ai/workflows/built-in.md#security-hunt), your own [workflows](https://docs.enclave.ai/workflows/overview.md), and [PR review](https://docs.enclave.ai/risk/pr-analysis.md). You review them in **Risk**.

![The Findings tab on the Risk page, listing findings with their repository, file, and severity](https://mintcdn.com/enclave/bhnFMg4ldiTYrwZX/images/product/findings.png?fit=max\&auto=format\&n=bhnFMg4ldiTYrwZX\&q=85\&s=edda3998bc04478e203c83f549f4bc79)

## How a finding is confirmed

Before a finding shows as confirmed, Enclave:

1. **Deduplicates** it against your existing findings.
2. **Verifies** it with an independent agent that reads the code beyond the reported files.
3. **Assesses exploitability** against your environment, to see whether an attacker can reach it.

## The Risk page

| Tab | Shows |
| - | - |
| **Active risks** | Confirmed findings an attacker can reach now |
| **Findings** | Every finding, in every state |
| **PR findings** | Issues found in pull requests. See [PR findings](https://docs.enclave.ai/risk/pr-analysis.md#pr-findings-in-risk). |

Filter by **State**, **Severity**, or **Exploitability**, or search by text. Filters are saved in the URL, so you can share a view.

## What a finding contains

![A finding page showing the vulnerability summary, affected files, exploitability, and affected assets](https://mintcdn.com/enclave/bhnFMg4ldiTYrwZX/images/product/finding-detail.png?fit=max\&auto=format\&n=bhnFMg4ldiTYrwZX\&q=85\&s=103f1440ef20720ea803a0092279c4c0)

* **Summary:** what the flaw is, where it is, and what an attacker gains.
* **Proof of concept:** how it was demonstrated, so you can reproduce it.
* **Attack path:** the chain from entry point to the flaw, when exploitability is confirmed.
* **Exploitability:** whether the flaw is reachable in your environment, and why.
* **Affected assets:** the services and cloud resources involved.

Click **Export PDF** to download a report, or **Copy as markdown** to paste it into a ticket.

### Exploitability

| Verdict | Meaning |
| - | - |
| **Confirmed** | A path from the internet to the impact is proven |
| **Likely real** | Strong evidence, with one step inferred |
| **Access control may block this** | The attacker needs meaningful access first |
| **Code evidence only** | The flaw exists in code, with no evidence it's deployed |
| **No public path confirmed** | Something concrete blocks the path |
| **Running app not checked** | Enclave is missing the data to decide |
| **Evidence is out of date** | The assessment needs to run again |

### Severity

| Severity | Meaning | Example |
| - | - | - |
| **Critical** | Remote and unauthenticated, with serious impact | Remote code execution |
| **High** | Remote, with a common precondition such as a login | SQL injection behind login |
| **Medium** | An uncommon precondition, or limited impact | CSRF on a non-critical action |
| **Low** | Defense in depth, or minimal impact | A missing security header |

Severity can change when Enclave learns more about where the code runs.

## Statuses

| Status | Meaning |
| - | - |
| **Needs evidence** | Reported, but not confirmed yet |
| **Confirmed** | Real and still open |
| **Resolved** | Fixed |
| **Inactive** | Not a real issue. Enclave can reopen it if new evidence appears. |
| **Dismissed** | You decided not to act. Enclave never reopens it. |

To change a status, open a row's **⋯** menu, or click the status on the finding's page. Every change is recorded with who made it.

## Triage from Research

Ask Research to work your queue in plain language, for example:

* `Dismiss every low-severity finding in legacy-admin`
* `Mark the three SSRF findings in payments-api as resolved`
* `Update the proof of concept for this finding with the steps we just ran`

Research shows an approval card before it changes anything. One approval covers up to 100 findings. To point at specific findings, paste their links or attach them with **Add context**.

## A weekly routine

1. Open **Active risks** and start with **Critical** and **High**.
2. Mark what isn't real **Inactive**, and what you won't fix **Dismissed**.
3. Hand the rest to the owning team, and mark them **Resolved** when the fix ships.
4. Ask Research: `Which findings still need evidence, and what would verify them?`


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.