Skip to main content

Security Issues

Overview​

The Issues page centralizes security findings from your attack surface. Track vulnerabilities, misconfigurations, and exposures with a structured remediation workflow.

Issue Sources​

Discovery Findings​

Issues discovered through scanning:

  • Open ports exposing services
  • Outdated software versions
  • Misconfigured servers
  • Expired certificates
  • Missing security headers

Penetration Testing​

Findings from pentest campaigns:

  • Exploitable vulnerabilities
  • Business logic flaws
  • Authentication issues
  • Injection points

Manual Reports​

User-reported issues:

  • Bug bounty submissions
  • Internal discoveries
  • Third-party notifications

Issue Dashboard​

Key Metrics​

MetricDescription
Total OpenUnresolved issues
Critical/HighSevere issues
AgingIssues past SLA
ResolvedRecently fixed

Views​

ViewContent
All IssuesComplete issue list
My IssuesAssigned to you
CriticalHighest severity only
AgingPast remediation SLA

Issue Severity​

Severity Levels​

LevelDescriptionSLA
CriticalImmediate exploitation risk24 hours
HighSignificant risk7 days
MediumModerate risk30 days
LowMinimal risk90 days
InformationalNo direct riskNo SLA

Severity Factors​

What determines severity:

  • Exploitability
  • Data exposure risk
  • System criticality
  • Internet accessibility
  • Existing controls

Issue Details​

Issue Fields​

FieldDescription
TitleBrief description
SeverityRisk level
AssetAffected asset
CategoryIssue type
DescriptionFull details
EvidenceSupporting proof
RemediationFix instructions
StatusCurrent state

Evidence​

Evidence includes:

  • Screenshots
  • Request/response logs
  • Tool output
  • Steps to reproduce

Issue Workflow​

Status Flow​

New → Confirmed → In Progress → Fixed → Verified → Closed
         ↓                        ↓
    Won't Fix               Reopened

Status Definitions​

StatusMeaning
NewJust discovered
ConfirmedVerified as valid
In ProgressBeing remediated
FixedRemediation applied
VerifiedFix confirmed working
ClosedIssue resolved
Won't FixAccepted risk
ReopenedIssue returned

Managing Issues​

Triaging Issues​

When new issue arrives:

  1. Review issue details
  2. Verify it's valid
  3. Assess severity
  4. Assign to owner
  5. Set target date

Assigning Issues​

  1. Open issue
  2. Click Assign
  3. Select owner
  4. Add notes
  5. Save

Updating Status​

  1. Open issue
  2. Click Update Status
  3. Select new status
  4. Add comment explaining change
  5. Save

Remediation​

Remediation Guidance​

Each issue includes:

  • Description of the problem
  • Why it matters
  • How to fix it
  • Verification steps

Remediation Steps​

  1. Understand

    Review issue details and impact.

  2. Plan

    Determine remediation approach.

  3. Implement

    Apply the fix.

  4. Verify

    Confirm the issue is resolved.

  5. Close

    Mark issue as closed.

Verification​

Before closing:

  1. Re-test the vulnerability
  2. Confirm it's not exploitable
  3. Document verification method
  4. Request independent verification (for high/critical)

False Positives​

Handling False Positives​

When a finding isn't valid:

  1. Open issue
  2. Click Mark as False Positive
  3. Provide explanation
  4. Add evidence
  5. Submit

False Positive Review​

False positives are reviewed:

  • Automated checks updated
  • Prevent future false positives
  • Maintain accuracy

Risk Acceptance​

When to Accept Risk​

Accept risk when:

  • Remediation cost exceeds risk
  • Compensating controls exist
  • Business requires the configuration
  • Technical limitations prevent fix

Accepting Risk​

  1. Open issue
  2. Click Accept Risk
  3. Provide justification
  4. Set review date
  5. Get approval (if required)
  6. Submit

Risk Acceptance Review​

Accepted risks are reviewed:

  • Periodic re-evaluation
  • Manager approval
  • Documentation for audits

Reporting​

Issue Reports​

Generate reports:

  • Open issues summary
  • Issues by severity
  • Issues by asset
  • Aging report
  • Trend analysis

Compliance Evidence​

Issue management provides evidence for:

FrameworkRequirement
SOC 2CC7.1, CC7.2
ISO 27001A.12.6.1

Integration​

Alerting​

Configure alerts for:

  • New critical issues
  • SLA breaches
  • Status changes
  • Issue reopened

Best Practices​

Triage Quickly

New issues should be triaged within 24 hours. Assign owners promptly.

Meet SLAs

Track SLA compliance. Escalate aging issues before they breach.

Verify Fixes

Always verify remediation. Don't just trust "it's fixed."

Document Everything

Maintain clear records for audit purposes.

Next Steps​

Code Security

Monitor code repositories

Penetration Testing

Manage pentest programs