Skip to main content
False positives are security findings that aren’t actually vulnerabilities. Learn how to identify and manage them effectively.

​
What Are False Positives?

A false positive is a violation reported by security tools that isn’t actually exploitable or doesn’t represent a real security risk.

​
Common Causes

Validation Not Detected

Input is validated but tool doesn’t recognize the pattern

Framework Protection

Framework provides automatic protection but tool doesn’t know

Test Code

Security rules flag test/mock code

Context Misunderstood

Tool lacks context about how code is used

​
Examples

​
Framework Auto-Escaping

// Reported as XSS vulnerability
function UserProfile({ userName }) {
  return <div>{userName}</div>;
}
Why false positive: React automatically escapes JSX expressions. Not vulnerable to XSS.

​
Input Validation

# Reported as SQL injection
def get_user(user_id):
    if not user_id.isdigit():
        raise ValueError("Invalid user ID")
    query = f"SELECT * FROM users WHERE id = {user_id}"
Why false positive: user_id validated to contain only digits. SQL injection impossible.

​
Identifying False Positives

Ask these questions:
  • Is input validated? Check if input is validated before reaching the sink
  • Does framework protect? Check if framework provides automatic protection
  • Is this production code? Check if code is in test/mock directories
  • Is context different? Consider full execution path and infrastructure protections
Be conservative when marking false positives. When in doubt, consult security experts or treat as real until proven otherwise.

​
AI-Powered False Positive Elimination

CodeThreat’s AI automatically analyzes violations to identify false positives.

​
How AI Helps

1

Context Analysis

AI examines full code context, not just flagged line
2

Dataflow Tracking

AI traces data from source to sink across files
3

Framework Understanding

AI recognizes framework-specific security controls
4

Pattern Learning

AI learns your codebase patterns and improves over time
5

Automatic Marking

AI marks likely false positives with justification

​
Enable AI Filtering

1

Open Repository Settings

Repository → Settings → AI Features
2

Enable False Positive Elimination

Toggle False Positive Elimination to enabled
3

Configure Aggressiveness

Choose filtering level:
  • Conservative: Only obvious false positives
  • Balanced: Default (recommended)
  • Aggressive: Filter more aggressively
4

Save and Rescan

Save settings and trigger new scan

​
Manual Suppression

When AI doesn’t catch a false positive, manually suppress it.

​
How to Suppress

1

Open Violation

Click the false positive violation
2

Click Suppress

Click Suppress button
3

Provide Justification

Required: Explain why this is a false positiveGood examples:
  • “Input validated on line 42 with regex ^[0-9]+$ before use”
  • “React automatically escapes JSX expressions, not vulnerable to XSS”
  • “Test code using mock credentials, not production secret”
Bad examples:
  • “False positive” (not specific)
  • “This is fine” (no explanation)
  • “Low priority” (not a justification)
4

Confirm

Click Suppress to save

​
Suppression Best Practices

  • Be specific: Explain exactly why it’s a false positive
  • Reference code: Mention line numbers or functions
  • Provide evidence: Link to framework documentation if relevant
  • Review periodically: Revisit suppressions when code changes
  • Don’t suppress to hit metrics: Only suppress genuine false positives
Suppression justifications help the AI learn. Detailed explanations improve future false positive filtering.

​
Bulk Suppression

Suppress multiple similar false positives at once:
  1. Filter violations to show only those you want to suppress
  2. Select violations using checkboxes
  3. Click Bulk Actions → Suppress Selected
  4. Provide justification
  5. Review count and click Suppress All

​
Reviewing Suppressions

Periodically review suppressions to ensure they’re still valid:
  1. Filter by Status = Suppressed
  2. Sort by date suppressed (oldest first)
  3. Read suppression justifications
  4. Verify they’re still valid
  5. Unsuppress if code changed or justification invalid

​
Best Practices

  • Enable AI false positive elimination
  • Provide detailed suppression justifications
  • Review suppressions quarterly
  • Don’t suppress to game metrics
  • Focus on prevention over suppression

​
Next Steps

AI False Positive Elimination

Learn about autonomous investigation

Managing Violations

Complete violation workflow