Core concepts and terms
Every screen in Vulinder rests on a handful of concepts. Once you grasp these five (organization -> service -> analysis -> finding -> triage), everything else reads naturally. Word definitions are gathered separately in the Glossary.
Organization
The top-level boundary for all data. Services, members, results, and settings are isolated per organization, and you cannot access another organization's data. A single user can belong to multiple organizations and holds a role (administrator / manager / member) within each. (Members and Roles)
Service
Represents a single analysis target. A service has a type, and the type determines which analyses can be run.
- Source code : A Git repository. SAST, SCA, Secret, IaC, SBOM / License.
- Container image : Registry / uploaded images. SCA, SBOM, image hardening.
- Web service : A running web URL. DAST (after domain ownership verification).
- Server / host : A server connected over SSH. OS / package SCA, infrastructure checks (K8s / CIS), runtime monitoring.
- SBOM upload : An uploaded SBOM (CycloneDX / SPDX). Component SCA / License.
Analysis (scan type)
An individual security analysis run against a service. Analyses are divided by "what they look at."
| Type | What it looks at | Service types it is mainly used with |
|---|---|---|
| SAST | Code-level vulnerabilities in source code (static analysis) | Source code |
| SCA | Known CVEs in open-source dependencies | Source, image, host, SBOM |
| DAST | Dynamic vulnerabilities in a running web service | Web service |
| SBOM · License | Component inventory and license risk | Source, image, SBOM |
| IaC | Configuration flaws in infrastructure code such as Terraform / K8s / Dockerfile | Source code |
| Secret | Hardcoded keys / tokens / passwords | Source code |
SCA and SBOM span multiple service types, so they are covered in each type's section in the appropriate context. (For example, Image SCA, Host OS vulnerabilities)
Scan run
A single analysis run against a service at a specific point in time. Each run leaves a result snapshot, and when you rescan, resolved / recurring / new items are calculated automatically against the previous run. This lets you track "are we getting better than last week."
Finding
A single vulnerability discovered by an analysis. It has a severity, location, description, references (CVE / CWE), and more. Severity is shown with six fixed-color levels.
CRITICAL HIGH MEDIUM LOW INFO KEVKEV is a separate axis from severity, marking vulnerabilities with "confirmed active exploitation." Even at the same severity, handle KEV-tagged items first.
Triage
The work of reviewing a finding and deciding its status. Vulinder simplifies closing into two options.
- False Positive : Not a real risk. Permanently suppressed by fingerprint, so it does not reappear in the next scan.
- Accepted Risk : The risk is acknowledged, but you have decided not to address it now.
Items you do not process remain open, and if they are not rediscovered after remediation, they are counted as resolved. For details, see Triage.
Security score and compliance
- Security score quantifies the security posture of your organization / service by aggregating discovered risks and tracks the trend.
- Compliance maps findings to standards such as OWASP / CWE / KISA to show your compliance status.