Skip to main content

Status dictionary

This collects the meaning of the status indicators and badges that appear throughout the app. For word definitions, see the Glossary; for how concepts relate, see Core concepts.

Scan status​

The status shown per analysis on the [Services] card.

  • Not run Not yet scanned (not measured). Shown in coverage as "what has not been checked."
  • Done Scan complete. A result snapshot is kept.
  • At risk The scan completed and found CRITICAL items.
    • Secret : Any finding.
    • SBOM · License : Licenses that need review.

Scans run asynchronously and continue even if you close the window.

While a scan runs, the Run analysis button in the analysis tab changes to "Analyzing…" and a progress bar appears.

Finding handling status​

The handling status of a single finding. You close an item yourself by choosing resolved, false positive or accepted risk in the detail panel. Rescan results do not close items automatically.

  • Open (open) : not yet handled (default state).
  • False positive (false positive) : handled as not a real risk. Does not return to open even if a later rescan detects it again, and stays listed as a false positive.
  • Accepted risk (accepted risk) : the risk is acknowledged but not remediated for now. Can be given an expiry.
  • Resolved (resolved) : an item closed by clicking Resolved in the detail panel.
  • Recurred : a resolved item was detected again in a rescan and returned to open.

An item that a rescan no longer detects drops out of the current results without a status change.

Severity · priority​

The risk level of a finding. Shown with five fixed-color levels; items without a score show as UNKNOWN. KEV is a separate axis.

CRITICAL HIGH MEDIUM LOW INFO UNKNOWN
  • KEV A vulnerability confirmed to be actively exploited. It is a separate axis from severity; at the same severity, handle KEV items first.

License risk​

The SBOM · License screen shows the license risk of each component.

  • Copyleft Copyleft license with distribution-condition caution (GPL, AGPL, etc.). Requires review for commercial distribution.
  • Unknown The license could not be identified.
  • Permissive Generally low risk (MIT, Apache-2.0, etc.).