Understanding results
Read scan status, coverage, proof, and policy outcomes before deciding what to investigate or fix.
Read the result in contextPermalink to Read the result in context
Use the result page to decide whether an assessment supports a remediation task, needs further validation, or needs another scan. You need access to the workspace and a scan with a result available. A finished run can still be waiting for its result; an unavailable result is not an empty assessment.
Confirm what was assessed
Open the run from Scan history. Check the repository, branch or ref, assessed version, and date before comparing it with current code.
Read status and coverage first
Read the headline, coverage statement, and Scope and limits notes where supplied. Resolve limits before using a low finding count to make a release decision.
Separate findings from candidates
Review confirmed findings and the separate Awaiting review items. Candidate severities are proposed, not established.
Read the policy verdict, if present
Check each stated reason. A missing verdict is not a policy pass, and a passing policy is not a guarantee of security.
Understand the headlinePermalink to Understand the headline
| Headline | Interpretation and next action |
|---|---|
| No issues found | The scan completed without reported findings and met the conditions for this result. Retain its scope and date; it does not establish complete coverage of every security issue. |
| One or more findings | Review the reported issues, their proof states, and the coverage statement. The finding count alone does not describe the whole assessment. |
| Completed · limited coverage | The run ended, but coverage was insufficient. Review any findings and limitations; do not treat an empty list as all clear. |
| Completed · not a clean result | The result does not support a clean reading, even if coverage is marked adequate. Read the explanation and investigate unresolved candidates or incomplete validation. |
| Results require internal review | Results are withheld pending review. Follow the message and contact support if you need help; no security conclusion is available yet. |
| Scan canceled | The scan was stopped. Start a new scan if an assessment is still needed. |
Failed scans have more specific messages when a cause is available. They are not clean results, regardless of the displayed finding count.
Coverage and unresolved workPermalink to Coverage and unresolved work
Coverage describes whether the scan examined enough of its intended source scope to support the assessment. Coverage adequate does not mean every file, runtime behavior, configuration, or possible vulnerability has been tested. Read any methodology and limitation notes with the counts.
Insufficient coverage is not all clear
Where the result shows candidate-review information, distinguish candidates detected, reviewed, and accounted for. Unresolved candidates, incomplete validation, or candidates that cannot be accounted for can prevent a clean result even when the coverage badge is adequate. A missing measurement is not zero, and accounting for a candidate is not the same as confirming it.
Read the specific limitation before rerunning. Correct any access or scope issue you control, then run another assessment if appropriate. If the same limitation persists, give support the scan ID and the visible message; repeating a scan does not guarantee broader coverage.
Choose the next actionPermalink to Choose the next action
- Confirmed finding: inspect the evidence and affected code, assess the impact in your application, and plan a fix or record a reasoned triage decision.
- Needs validation or Unconfirmed: investigate the lead before treating it as established. A high severity does not turn it into a confirmed vulnerability.
- Awaiting review: use the supplied title and location to investigate. These candidates are separate from the confirmed findings and severity figures.
- Policy failed: read every reason. Address confirmed issues, unknown severity, or coverage limitations as appropriate rather than assuming every policy failure is a code defect.
- No issues found: keep the result as evidence of this assessment, not a guarantee about untested areas or future changes.
When a scan cannot finishPermalink to When a scan cannot finish
| Message | What to do |
|---|---|
| Could not access the repository | Check repository access and the connection, restore permission where needed, then retry. |
| Scan could not start · configuration | Read the accompanying message. Try again after correcting any stated issue, or contact support if the cause is unclear. |
| Scan failed on our side | The scan encountered a failure or timeout. Retry when appropriate and report repeated failures with the scan ID. |
| Scan failed safely | No usable assessment is available. Follow the visible explanation rather than reading an empty list as a pass. |
When a result is not readyPermalink to When a result is not ready
Preparing your results means the run finished before its result became available. Use Check again or reopen it from history. If the result remains unavailable, keep the scan ID and contact support. A failed request to load a result says nothing about whether the code has findings.
Share the assessment without losing contextPermalink to Share the assessment without losing context
The result header offers JSON and CSV exports. Keep the scan status and coverage information with any findings you share. These files are scan-result exports, not complete copies of every panel; preserve relevant scope notes, policy reasons, and Awaiting review items separately in your handoff.