Findings and export

Findings are read and managed in the app, on the Findings page. The endpoints behind it (/v1/repo-vulnerabilities) serve the app and need a signed-in user. CI credentials can't call them: a CI key or token can only create scans.

If you need your findings somewhere else, such as an audit folder or a spreadsheet, use the export.

---

Filtering

The Findings page filters by severity, state, scanner (sca, iac, secrets), project and assignee, and searches rule, description and location.

---

Export

On the Findings page, Export downloads the findings that match your current filters as CSV or JSON. It is available to Admin and Owner roles, on Team plans and above.

Detail	Value
Formats	CSV (UTF-8 with BOM, for Excel) or JSON
Size	Up to 10,000 rows. If you have more, narrow the filters

CSV columns:

id, fingerprint, project_name, rule_id, severity, status, scan_type, location, description, fix_available, is_breaking, is_direct, cwe, assigned_to, accepted_by, accepted_reason, accepted_until, sla_deadline, sla_breached, first_seen, last_seen

The export includes sla_deadline and sla_breached, so it works as evidence for audits. See SLA. Business plans also include a SOC 2 evidence report in Compliance.

---

Changing a finding's state

States, who can change them and what each requires are described in Vulnerability states.