> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codethreat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Understanding Violations

> What violations are and how they're tracked

A violation is a security finding detected during a scan. Understanding how violations work helps you manage and fix security issues effectively.

## What is a Violation?

A violation represents a specific security issue in your code:

<CardGroup cols={2}>
  <Card title="Location" icon="location-dot">
    Specific file, line number, and code snippet
  </Card>

  <Card title="Severity" icon="triangle-exclamation">
    CRITICAL, HIGH, MEDIUM, LOW, or INFO
  </Card>

  <Card title="Type" icon="tag">
    SAST, AGENTIC\_SAST, SCA, SECRET, or IAC
  </Card>

  <Card title="Status" icon="circle-check">
    OPEN, FIXED, FALSE\_POSITIVE, ACCEPTED\_RISK
  </Card>
</CardGroup>

***

## Violation Information

Every violation includes:

### Identification

* **ID**: Unique identifier (e.g., `VIO-2024-001234`)
* **Hash**: Fingerprint for deduplication
* **Rule ID**: Detection rule that found it

### Location

* **File path**: Where the issue exists
* **Line number**: Exact location in code
* **Code snippet**: Context around the issue
* **Repository**: Which repo contains it
* **Branch**: Which branch it was found on

### Classification

* **Type**: SAST, AGENTIC\_SAST, SCA, SECRET, or IAC
* **Category**: Injection, XSS, Crypto, etc.
* **CWE**: Common Weakness Enumeration (e.g., CWE-89)
* **CVE**: For dependency vulnerabilities

### Severity Assessment

* **Severity level**: CRITICAL, HIGH, MEDIUM, LOW, INFO
* **CVSS score**: Technical severity (0-10)
* **EPSS score**: Exploitation probability (0-100%)

### Status and Lifecycle

* **Status**: OPEN, FIXED, FALSE\_POSITIVE, ACCEPTED\_RISK
* **First detected**: When first found
* **Last seen**: Most recent scan showing it
* **Reviewed by AI**: Whether AI analyzed it

***

## Violation Types

### SAST Violations

Code-level vulnerabilities in your source code.

**Example**: SQL injection in user controller

**Characteristics**:

* Location: Specific code line
* Fix: Change code implementation
* Persistent: Remains until code is fixed

### SCA Violations

Vulnerabilities in dependencies and third-party libraries.

**Example**: CVE-2024-1234 in lodash package

**Characteristics**:

* Location: Package manifest
* Fix: Update dependency version
* May affect multiple locations

### Secret Violations

Exposed credentials and sensitive data.

**Example**: Hardcoded API key in config file

**Characteristics**:

* Location: Any file containing secret
* Fix: Remove secret, use environment variable, rotate credential
* Critical: Even after removal, secret may be in Git history

### IaC Violations

Misconfigurations in infrastructure-as-code.

**Example**: Public S3 bucket configuration

**Characteristics**:

* Location: Infrastructure definition files
* Fix: Update IaC configuration
* Preventive: Catches issues before deployment

***

## Violation Lifecycle

Violations move through states:

1. **OPEN**: New violation detected
2. **FIXED**: Vulnerability has been fixed
3. **FALSE\_POSITIVE**: Not a real security issue
4. **ACCEPTED\_RISK**: Real vulnerability, risk accepted

***

## Next Steps

<CardGroup cols={2}>
  <Card title="Managing Violations" icon="list-check" href="/findings/managing-violations">
    Triage and fix violations
  </Card>

  <Card title="False Positives" icon="filter" href="/findings/false-positives">
    Identify and manage false positives
  </Card>
</CardGroup>