> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codethreat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing Violations

> Triage, assign, fix, and track security violations

Effective violation management ensures security issues get fixed quickly.

## Workflow

<Steps>
  <Step title="Triage">
    Review violations, assess severity and priority
  </Step>

  <Step title="Assign">
    Assign to team members responsible for fixing
  </Step>

  <Step title="Fix">
    Developer fixes the vulnerability
  </Step>

  <Step title="Verify">
    Re-scan confirms violation is fixed
  </Step>

  <Step title="Track">
    Monitor metrics and trends
  </Step>
</Steps>

***

## Triaging Violations

When new violations appear, triage them quickly.

### Triage Checklist

* **Assess severity**: Critical/High/Medium/Low?
* **Check EPSS**: Is it actively being exploited?
* **Identify ownership**: Who should fix this?
* **Determine priority**: When should this be fixed?
* **Validate**: Real vulnerability or false positive?

### Triage Actions

<Tabs>
  <Tab title="Assign">
    Assign to team member who:

    * Owns the affected code
    * Has expertise in vulnerability type
    * Is working on related changes
  </Tab>

  <Tab title="Suppress">
    Mark as suppressed if:

    * Confirmed false positive
    * Accepted business risk
    * Test/mock code
    * Already mitigated at infrastructure level
  </Tab>

  <Tab title="Escalate">
    Escalate if:

    * Critical vulnerability in production
    * Actively exploited (high EPSS)
    * No clear owner
    * Requires architectural changes
  </Tab>
</Tabs>

***

## Assigning Violations

### How to Assign

<Steps>
  <Step title="Select Violation">
    Click the violation to assign
  </Step>

  <Step title="Click Assign">
    Click **Assign** in violation detail view
  </Step>

  <Step title="Choose Assignee">
    Select team member from dropdown
  </Step>

  <Step title="Add Note (Optional)">
    Provide context or priority
  </Step>

  <Step title="Set Due Date (Optional)">
    Set deadline based on severity:

    * Critical: Today
    * High: Within 1 week
    * Medium: Within 1 month
    * Low: Backlog
  </Step>
</Steps>

### Best Practices

* Assign based on code ownership
* Limit violations per person
* Use due dates for urgency
* Notify assignee via comment or Slack
* Balance security work with features

***

## Fixing Violations

### Fix Workflow

<Steps>
  <Step title="Understand the Issue">
    Read violation description and remediation guidance
  </Step>

  <Step title="Reproduce">
    Understand the vulnerable code path
  </Step>

  <Step title="Implement Fix">
    Apply recommended remediation
  </Step>

  <Step title="Test">
    Verify fix doesn't break functionality
  </Step>

  <Step title="Push Code">
    Commit and push fix with violation ID
  </Step>

  <Step title="Re-Scan">
    Trigger new scan or wait for automated scan
  </Step>

  <Step title="Verify">
    Confirm violation is marked as FIXED
  </Step>
</Steps>

### Example: Fixing SQL Injection

**Vulnerable**:

```python theme={null}
def get_user(user_id):
    query = f"SELECT * FROM users WHERE id = {user_id}"
    return db.execute(query)
```

**Fixed**:

```python theme={null}
def get_user(user_id):
    query = "SELECT * FROM users WHERE id = ?"
    return db.execute(query, (user_id,))
```

***

## Suppressing Violations

Change violation status when it's not a real security issue or is accepted risk.

### FALSE\_POSITIVE Status

Use for violations that aren't real security issues:

* Genuine false positives
* Test/mock code
* Framework provides protection
* Not exploitable in context

### ACCEPTED\_RISK Status

Use when vulnerability is real but risk is accepted:

* Business decision to accept risk
* Mitigated by compensating controls
* Fix would break critical functionality
* Temporary acceptance with fix deadline

<Warning>
  Never suppress real vulnerabilities as FALSE\_POSITIVE to improve metrics. Integrity matters more than perfect scores.
</Warning>

***

## Bulk Actions

Manage multiple violations at once:

* **Bulk assign**: Assign multiple violations to team member
* **Bulk suppress**: Mark multiple false positives
* **Bulk link**: Link to Jira/GitHub issues
* **Bulk export**: Export violations for reporting

***

## Violation Statuses

* **OPEN**: Active violation requiring action
* **FIXED**: Vulnerability has been fixed
* **FALSE\_POSITIVE**: Not a real security issue
* **ACCEPTED\_RISK**: Real vulnerability, risk accepted

***

## Best Practices

* Triage violations within 24 hours
* Assign critical violations immediately
* Set realistic due dates
* Track violation metrics
* Review suppressions quarterly
* Don't suppress to game metrics

***

## Next Steps

<CardGroup cols={2}>
  <Card title="Understanding Violations" icon="info-circle" href="/findings/understanding-violations">
    Learn about violation structure
  </Card>

  <Card title="False Positives" icon="filter" href="/findings/false-positives">
    Identify and suppress false positives
  </Card>
</CardGroup>