Skip to main content

Find and triage vulnerabilities

Use the organization Vulnerabilities page when you need to decide what to fix first across projects. Open a project when you need findings for one repository, one build, or one Generic project's uploaded SBOMs.

Start with the highest-priority findings​

  1. Open Vulnerabilities at organization scope.
  2. Use the summary cards for Known Exploited Vulnerabilities and Critical and High Vulnerabilities, including how many findings RunSafe mitigates and how many have fixes available.
  3. Use Top priority projects to open the projects or uploaded SBOM sources with the most distinct critical, high, or known-exploited vulnerabilities.
  4. In the table, filter or sort from the table controls. Known-exploited and high-scoring vulnerabilities appear first by default.
  5. Select the view icon on a row to open that finding's SBOM report.

What the organization list includes​

For each enabled GitHub or GitLab project, the organization page includes findings from the latest complete scan on the project's default branch. It also includes every complete manually uploaded SBOM in the organization, including multiple uploads for the same Generic project.

To inspect findings for a non-default branch:

  1. Open the project from Projects.
  2. Select the build you need.
  3. Open that project's Vulnerabilities view.

Generic projects summarize the latest uploaded SBOM data instead of a build.

Triage Carry-Forward​

When a new scan finds a vulnerability that you already triaged on a matching earlier scan, the Platform carries forward the previous state. Matching uses the same connected project, git ref, SBOM file path, and language context.

That keeps decisions such as Resolved, Not affected, or False positive when the SBOM for the same branch is regenerated.

Automatic triage for compiled C/C++ components​

For SBOMs produced by the RunSafe C/C++ SBOM generator, the Platform can mark some findings Not affected when the CVE description names source files that are not present in the SBOM.

Automatic triage applies only to CycloneDX components tagged as compiled (the generator sets a compiled component tag). Components without that tag stay open for human triage so vulnerabilities in uncompiled or incomplete binary context are not dismissed automatically.

How triage changes pipeline checks​

Vulnerability compliance checks count findings that are not triaged, marked Exploitable, or still In triage. Findings triaged as Resolved, Not affected, or False positive do not count toward critical/high or known-exploited thresholds. See thresholds for more details.