Docs / Program / Findings
Program · Findings

Findings

The Findings page brings every vulnerability across SAST, SCA, DAST, IAST and AI penetration testing into one place — so you can see and prioritize your whole security picture without hopping between modules.

The unified findings view

Open Findings from the sidebar. At the top, a Posture donut summarizes open findings by severity, and a By source panel splits them across the modules that produced them — SAST, SCA, DAST, IAST and AI Pentest — so you can see where your risk is concentrated. Severity tabs let you jump straight to the criticals.

app.codesguard.io/dashboard/findings
Unified Findings page with posture donut, by-source breakdown and severity tabs
Findings unifies results from every module, with a posture donut, a by-source breakdown, and severity tabs.

Reading a finding

Each finding in the list shows, at a glance:

Severity
One of critical high medium low info.
Source
Which module found it — SAST, SCA, DAST, IAST or AI Pentest.
Tag
A classifier such as a CWE, a CVE, or the tool that produced it.
Title & location
A human-readable name and where it was found (a file and line, or a target).
Time
When it was discovered, with a link back to the originating scan or run.

Filtering

Narrow the list two ways: the severity tabs (All / Critical / High / Medium / Low / Info) and a source filter to focus on a single module. Use these together to build a worklist — for example, “all critical findings from AI Pentest.”

Where findings come from

Findings flow in from every module, but the deepest evidence lives with the scan that produced it:

SourceProduced byFull detail lives in
SASTStatic scans of your source.The SAST project & scan views (code snippet, dataflow, AI review).
SCAVulnerable dependencies from SAST scans.The SCA inventory and advisory cards.
DASTDynamic scans of a running target.The run that produced them.
IASTAn in-process runtime agent.The IAST run, with the request, code path and stack trace at the sink.
AI PentestAutonomous agent runs.The run with its reasoning trail and proof.
Findings page vs the dashboard The Findings page is the filterable list of issues. The Dashboard is the analytics — trends over time, findings by module, top vulnerability types, and the riskiest apps and dependencies. Use the dashboard to understand posture, Findings to work the queue.

One issue, not three

Because every module reports into the same queue with the same severity scale, CodesGuard can line up results that describe the same weakness. A risky code path flagged by SAST, confirmed reachable at runtime by DAST or IAST, and chained into a working exploit by AI Pentest is one correlated, deduplicated, prioritized issue — not three separate tickets in three tools. You fix it once and watch it clear everywhere on the next scan.

Acting on findings

CodesGuard's workflow is scan → fix → re-scan. To work through findings:

  1. Prioritize

    Start with critical and high. For SAST, use the FP % score to focus on what's most likely real; for SCA, start with known-exploited advisories and packages your code calls. For DAST and AI Pentest, proven exploits come first; IAST findings were all observed under real traffic.

  2. Understand the evidence

    Open the source scan or run to see the dataflow, code, or exploit proof behind the finding.

  3. Remediate

    Apply the recommended fix in your code, dependencies, or configuration.

  4. Re-scan to confirm

    Run the scan again. Resolved issues drop off, and the project's gate and your posture update automatically.