Vulnerabilities Workbench

​

Overview

The Vulnerabilities page provides an organization-wide view of open security findings. Use it to review findings across projects, investigate details, export results, and apply triage decisions without opening each scan separately. Findings are separated into these tabs:

• Secrets
• SAST
• Logic & Auth
• SCA Packages
• Containers
• IaC

Each tab is available only when you have permission to view that finding type. The badge on a tab shows its unfiltered open-finding count. Counts of 1,000 or more are shortened (for example, 1.8K). If the Workbench shows Almost ready, Corgea is preparing it for your organization. Finding counts, lists, exports, and bulk selection are unavailable until preparation finishes.

​

Find and review findings

Select a tab, then expand its groups and projects to reach individual findings. Grouping is tailored to each finding type—for example, SCA findings begin with packages, container findings with images, and IaC findings with rules. Counts of 1,000 or more are shortened (for example, 24.6K). Point at a shortened count to see the exact number. Project rows include an icon that opens the project page in a new tab. Use Previous, Next, and page numbers, when they appear, to move through grouped results. Each list shows the current row range and a total when Corgea has one. Use the status controls to switch between Open, Fixed, False Positive, and the other statuses available for that finding type. Click the filter icon to show severity, project, team, and tag filters. A count on the icon shows how many of those filters are set while the row is hidden. Hiding the row leaves them active. Selecting multiple tags shows findings from projects that have any selected tag. Tag matching is case-sensitive and must match the stored project tag exactly. SCA Packages adds a reachability filter on the main toolbar. On Secrets, SAST, Logic & Auth, and IaC, searching by file path requires an explicit Project filter. Expanding a project group alone does not enable file-path search. Without that filter, search matches secret subtypes, CWEs, or IaC rules, depending on the tab. The same search scope applies to group counts, exports, and bulk selections. Use the Team filter on any tab to show findings from projects owned by the selected team that you have permission to view. Combined with a project filter, it shows only projects that match both filters. The team filter also applies when expanding groups, exporting filtered results, and selecting all findings matching the current filters. Select a finding to open the same details panel used on scan pages. When auto-triage reasoning is available, the panel shows it on the Auto-Triage tab, selected by default, next to a Files Read tab that lists the files read during scanning. From the panel, you can review evidence, assign the finding, and change its status with Current Status. Use Open Full View when it is shown to open the full finding page. The address bar keeps the selected finding, so opening that link again restores the panel when the finding is still in the current results. A comment is required when changing a disposition, and it has to explain the decision rather than repeat it—see Triage Justifications. When you mark a supported finding as accepted risk, you can also choose when that expires. When an incremental scan rechecks an earlier SAST finding, it carries that finding into the new results only if it confirms the finding is still present. An unconfirmed finding remains on the earlier scan; its absence from the new results does not by itself mean it was fixed. Findings are marked fixed only on the main branch, when the code changes confirm their removal. SAST findings carried forward from a previous scan during an incremental scan retain their triage status, justification, assignee, due date, and accepted-risk expiry date. Carrying a finding forward does not reset or remove its due date or expiry date. When Corgea recognizes a finding at a corrected location, it can carry over an existing triage decision without replacing a decision already made on the new finding. In incremental branch scans, a matching finding in an unchanged file can also inherit the earlier decision; findings in files changed by that scan remain open for review. The finding history records Decision carried over from the finding’s previous location, with the previous location and original decision date when available. SCA and container findings show package details and history in that panel, plus reachability when it is available. If your company requires triage approval for False positive or Accepted risk, changing a Secrets, SAST, Logic & Auth, or SCA Packages finding to that disposition creates a request and leaves the finding unchanged. Containers and IaC change immediately. A different authorized reviewer can approve or reject a request from the approvals queue or the finding details. Requesters can withdraw their own pending requests. Findings awaiting review show a Pending approval badge beside their current status in the workbench and in expanded finding groups on scan pages.

​

Export findings

Click Export to download a CSV containing the findings that match the active tab, status, search, and filters. The export includes the latest occurrence of each finding and is limited to 25,000 rows. To export only particular findings, select them and click Export selection in the action bar.

​

Triage findings in bulk

Select individual findings or an expanded group. You can also choose Select all findings matching the current filters after making an initial selection. The bulk action bar lets you:

• Assign findings to a team member
• Change the selection to another status the active tab supports, including reopening a finding or accepting risk
• Export the selection

Click Change status, choose a Decision, and add a comment that explains the change. The menu lists that tab’s statuses except the one you are already viewing. For Accepted Risk, set Expiry Date (Optional) to a future time, or leave it empty so the acceptance does not expire. After that time, the finding returns to Open and Corgea sends a notification. IaC findings have no expiry date. When your company requires approval, a bulk change to False positive or Accepted Risk on Secrets, SAST, Logic & Auth, or SCA Packages is submitted for approval, and those findings keep their current status until it is approved. Containers and IaC change immediately. Someone who can approve triage requests applies the change immediately on every tab. Bulk status changes require a comment, and the same justification requirement applies: a comment that only repeats the decision is rejected and no status is changed. The action bar summarizes the number of selected findings, projects, and teams, and reports any findings that were skipped. A bulk selection can contain up to 1,000 findings.