Managing security vulnerabilities
Whenever any scanner except License Compliance finds a vulnerability, it grants that vulnerability the Needs Triage status. This status shows up in the vulnerability’s entry in the vulnerability report and the pipeline details page report.
You should decide what you intend to do about each vulnerability that has that status and change its status accordingly. Here are the possible status values:
- Dismissed means that you do not intend to remediate this vulnerability. Maybe you’ve determined that it’s a false positive, maybe you’ve decided it’s a real problem but isn’t worth fixing, or maybe you’ve realized that it doesn’t apply to your product or your users.
- Confirmed means that it’s a real problem, and you do intend to fix it. After setting a finding to this status, you would normally create an issue to track your progress as your team works to remediate this vulnerability...
