Skip to main content
Effective violation management ensures security issues get fixed quickly.

​
Workflow

1

Triage

Review violations, assess severity and priority
2

Assign

Assign to team members responsible for fixing
3

Fix

Developer fixes the vulnerability
4

Verify

Re-scan confirms violation is fixed
5

Track

Monitor metrics and trends

​
Triaging Violations

When new violations appear, triage them quickly.

​
Triage Checklist

  • Assess severity: Critical/High/Medium/Low?
  • Check EPSS: Is it actively being exploited?
  • Identify ownership: Who should fix this?
  • Determine priority: When should this be fixed?
  • Validate: Real vulnerability or false positive?

​
Triage Actions

Assign to team member who:
  • Owns the affected code
  • Has expertise in vulnerability type
  • Is working on related changes

​
Assigning Violations

​
How to Assign

1

Select Violation

Click the violation to assign
2

Click Assign

Click Assign in violation detail view
3

Choose Assignee

Select team member from dropdown
4

Add Note (Optional)

Provide context or priority
5

Set Due Date (Optional)

Set deadline based on severity:
  • Critical: Today
  • High: Within 1 week
  • Medium: Within 1 month
  • Low: Backlog

​
Best Practices

  • Assign based on code ownership
  • Limit violations per person
  • Use due dates for urgency
  • Notify assignee via comment or Slack
  • Balance security work with features

​
Fixing Violations

​
Fix Workflow

1

Understand the Issue

Read violation description and remediation guidance
2

Reproduce

Understand the vulnerable code path
3

Implement Fix

Apply recommended remediation
4

Test

Verify fix doesn’t break functionality
5

Push Code

Commit and push fix with violation ID
6

Re-Scan

Trigger new scan or wait for automated scan
7

Verify

Confirm violation is marked as FIXED

​
Example: Fixing SQL Injection

Vulnerable: 
def get_user(user_id):
    query = f"SELECT * FROM users WHERE id = {user_id}"
    return db.execute(query)
Fixed: 
def get_user(user_id):
    query = "SELECT * FROM users WHERE id = ?"
    return db.execute(query, (user_id,))

​
Suppressing Violations

Change violation status when it’s not a real security issue or is accepted risk.

​
FALSE_POSITIVE Status

Use for violations that aren’t real security issues:
  • Genuine false positives
  • Test/mock code
  • Framework provides protection
  • Not exploitable in context

​
ACCEPTED_RISK Status

Use when vulnerability is real but risk is accepted:
  • Business decision to accept risk
  • Mitigated by compensating controls
  • Fix would break critical functionality
  • Temporary acceptance with fix deadline
Never suppress real vulnerabilities as FALSE_POSITIVE to improve metrics. Integrity matters more than perfect scores.

​
Bulk Actions

Manage multiple violations at once:
  • Bulk assign: Assign multiple violations to team member
  • Bulk suppress: Mark multiple false positives
  • Bulk link: Link to Jira/GitHub issues
  • Bulk export: Export violations for reporting

​
Violation Statuses

  • OPEN: Active violation requiring action
  • FIXED: Vulnerability has been fixed
  • FALSE_POSITIVE: Not a real security issue
  • ACCEPTED_RISK: Real vulnerability, risk accepted

​
Best Practices

  • Triage violations within 24 hours
  • Assign critical violations immediately
  • Set realistic due dates
  • Track violation metrics
  • Review suppressions quarterly
  • Don’t suppress to game metrics

​
Next Steps

Understanding Violations

Learn about violation structure

False Positives

Identify and suppress false positives