Triage Vulnerabilities

After a scan completes, you’ll have a list of findings that need attention. This guide shows you how to systematically review, prioritize, and resolve them without getting overwhelmed.

The Triage Workflow

Understanding Severity vs Exploitability

Two scores help you prioritize:

A vulnerability with CVSS 9.0 but EPSS 0.001 is severe but rarely exploited. A vulnerability with CVSS 5.0 but EPSS 0.8 is moderate but actively targeted. EPSS helps you focus on real threats, not theoretical ones.

Action Types

For each finding, choose one of these actions:

Using AI-Powered Fixes

CodeStax provides AI-generated fix suggestions for most findings:

1. Click on a finding to open its detail view
2. Review the AI Explanation — it describes what the vulnerability is and why it matters
3. Click Fix with AI to generate a code fix
4. Review the suggested code change before applying
5. The fix includes the corrected code snippet and an explanation of what changed

Prioritization Matrix

Use this matrix to decide what to fix first:

Filtering and Searching

The scan results page provides several ways to narrow down findings:

• Filter by severity — Show only Critical, High, Medium, or Low
• Filter by scanner — Show only SAST, SCA, Secrets, IaC, or Quality findings
• Search by file — Find issues in a specific file or directory
• Sort options — By severity, CVSS score, EPSS score, or file path

Bulk Operations

For large scans with many findings:

1. Use filters to select a category of findings
2. Select multiple findings using checkboxes
3. Apply bulk actions: mark as false positive, assign to team member, or export

After Triage

Once you’ve triaged your findings:

• Set up quality gates to prevent new issues — see Set Up Quality Gates
• Enable PR reviews to catch issues before merge — see Set Up PR Reviews
• Configure notifications to get alerted on new Critical findings — see Email Notifications
• Track trends on the Code Health dashboard — see Monitor Code Health