Findings

Available since v0.0.2

Findings are individual security vulnerabilities discovered by scanners and ingested into servasec.

Lifecycle

A finding follows this status lifecycle:

open ──→ confirmed ──→ fixed ──→ open
  │                       │
  └──→ false_positive ←───┘

• Open - newly ingested, awaiting review
• Confirmed - triaged and acknowledged as a real issue
• Fixed - remediation applied, pending verification
• False Positive - determined to be a false positive or acceptable risk

Finding detail

Each finding page includes:

• Severity - Critical, High, Medium, Low, or Info
• Scanner - source scanner (Semgrep, Trivy, etc.)
• Location - file path and line number
• Description - detailed explanation of the vulnerability
• Remediation - suggested fix
• Risk score - combined severity, EPSS, age, and asset criticality
• References - links to relevant documentation or CVEs
• Comments - threaded discussion per finding
• Assignee - responsible team member
• Timeline - status change history

Assigning findings

Users can be assigned to findings for accountability:

PATCH /api/findings/{id}/assign
Content-Type: application/json

{
  "userId": 1,
  "dueDate": "2026-08-01T00:00:00Z"
}

Updating status

PATCH /api/findings/{id}/status
Content-Type: application/json

{
  "status": "confirmed"
}

Valid status values: open, confirmed, false_positive, fixed.

Reviewing findings

Mark a finding as reviewed and optionally update its status:

PATCH /api/findings/{id}/review
Content-Type: application/json

{
  "status": "fixed"
}

Comments

POST /api/findings/{id}/comments
Content-Type: application/json

{
  "content": "Reviewed the code, this is a valid XSS vector."
}

GET /api/findings/{id}/comments