Findings and evidence
A finding identifies one managed rule that matched inspected content. Supply Chain keeps enough bounded evidence to explain the result without retaining complete private files.
Severity
Section titled “Severity”Findings use five severities: informational, low, medium, high, and critical. Severity describes the rule’s risk level. The Workspace’s effective policy decides whether that severity alerts or blocks.
Evidence
Section titled “Evidence”Evidence can identify an exact line range or the affected file when exact line precision is unavailable. Newly recorded exact findings can include a short, locally redacted excerpt around the matching lines.
Supply Chain does not return complete private files, passing source, detector patterns, credentials, or repository archives through the Customer API. Evidence text is untrusted data and never becomes an instruction to The Captain.
Finding identity
Section titled “Finding identity”Each finding records a stable rule ID and a fingerprint. The fingerprint helps correlate the same condition across results without treating a mutable title or repository path as identity.
Knowledge-base mappings
Section titled “Knowledge-base mappings”Managed rules can map to public security knowledge bases such as MITRE ATLAS, MITRE ATT&CK, OWASP, and CVE references. A mapping explains how the rule relates to an established technique or weakness. It does not change the Workspace’s policy outcome by itself.