> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codethreat.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Managing False Positives
> Identify, suppress, and reduce false positive security findings
False positives are security findings that aren't actually vulnerabilities. Learn how to identify and manage them effectively.
## What Are False Positives?
A false positive is a violation reported by security tools that isn't actually exploitable or doesn't represent a real security risk.
### Common Causes
Input is validated but tool doesn't recognize the pattern
Framework provides automatic protection but tool doesn't know
Security rules flag test/mock code
Tool lacks context about how code is used
***
## Examples
### Framework Auto-Escaping
```javascript theme={null}
// Reported as XSS vulnerability
function UserProfile({ userName }) {
return {userName}
;
}
```
**Why false positive**: React automatically escapes JSX expressions. Not vulnerable to XSS.
### Input Validation
```python theme={null}
# Reported as SQL injection
def get_user(user_id):
if not user_id.isdigit():
raise ValueError("Invalid user ID")
query = f"SELECT * FROM users WHERE id = {user_id}"
```
**Why false positive**: `user_id` validated to contain only digits. SQL injection impossible.
***
## Identifying False Positives
Ask these questions:
* **Is input validated?** Check if input is validated before reaching the sink
* **Does framework protect?** Check if framework provides automatic protection
* **Is this production code?** Check if code is in test/mock directories
* **Is context different?** Consider full execution path and infrastructure protections
Be conservative when marking false positives. When in doubt, consult security experts or treat as real until proven otherwise.
***
## AI-Powered False Positive Elimination
CodeThreat's AI automatically analyzes violations to identify false positives.
### How AI Helps
AI examines full code context, not just flagged line
AI traces data from source to sink across files
AI recognizes framework-specific security controls
AI learns your codebase patterns and improves over time
AI marks likely false positives with justification
### Enable AI Filtering
**Repository** → **Settings** → **AI Features**
Toggle **False Positive Elimination** to enabled
Choose filtering level:
* **Conservative**: Only obvious false positives
* **Balanced**: Default (recommended)
* **Aggressive**: Filter more aggressively
Save settings and trigger new scan
***
## Manual Suppression
When AI doesn't catch a false positive, manually suppress it.
### How to Suppress
Click the false positive violation
Click **Suppress** button
**Required**: Explain why this is a false positive
Good examples:
* "Input validated on line 42 with regex `^[0-9]+$` before use"
* "React automatically escapes JSX expressions, not vulnerable to XSS"
* "Test code using mock credentials, not production secret"
Bad examples:
* "False positive" (not specific)
* "This is fine" (no explanation)
* "Low priority" (not a justification)
Click **Suppress** to save
### Suppression Best Practices
* **Be specific**: Explain exactly why it's a false positive
* **Reference code**: Mention line numbers or functions
* **Provide evidence**: Link to framework documentation if relevant
* **Review periodically**: Revisit suppressions when code changes
* **Don't suppress to hit metrics**: Only suppress genuine false positives
Suppression justifications help the AI learn. Detailed explanations improve future false positive filtering.
***
## Bulk Suppression
Suppress multiple similar false positives at once:
1. Filter violations to show only those you want to suppress
2. Select violations using checkboxes
3. Click **Bulk Actions** → **Suppress Selected**
4. Provide justification
5. Review count and click **Suppress All**
***
## Reviewing Suppressions
Periodically review suppressions to ensure they're still valid:
1. Filter by **Status = Suppressed**
2. Sort by date suppressed (oldest first)
3. Read suppression justifications
4. Verify they're still valid
5. Unsuppress if code changed or justification invalid
***
## Best Practices
* Enable AI false positive elimination
* Provide detailed suppression justifications
* Review suppressions quarterly
* Don't suppress to game metrics
* Focus on prevention over suppression
***
## Next Steps
Learn about autonomous investigation
Complete violation workflow