Understanding Scan Results
Scan History
Navigate to Dashboard → Scans to view all your scans.
Summary Statistics
At the top of the page, you’ll see:
- Total Scans — All scans across your workspace
- Completed — Successfully finished scans
- In Progress — Currently running scans
- Total Issues — Sum of all findings
Scan Table
Each scan shows:
| Column | Description |
|---|---|
| Repository | Name of the scanned repository |
| Status | Clean, N Issues, In Progress, or Error |
| Type | Smart Scan or Deep Scan |
| Duration | How long the scan took |
| Date | When the scan was triggered |
Status badges are color-coded:
- 🔵 Blue — Clean (no issues)
- 🟡 Amber — In progress
- 🔴 Red — Issues found or scan failed
Finding Details
Each vulnerability finding includes:
Severity Levels
| Level | Color | Description |
|---|---|---|
| Critical | Red | Exploitable vulnerabilities requiring immediate action |
| High | Orange | Serious vulnerabilities that should be fixed soon |
| Medium | Yellow | Moderate risk, should be addressed in next sprint |
| Low | Blue | Minor issues, fix when convenient |
Finding Fields
- Title — What the vulnerability is
- Description — Detailed explanation
- File Path — Exact file and line number
- Scanner — Which tool detected it (Semgrep, Trivy, Gitleaks, etc.)
- CWE ID — Common Weakness Enumeration reference
- Remediation — How to fix it, with code examples when available
AI-Powered Remediation (Deep Scan)
For Deep Scans, each finding includes AI-generated remediation advice:
- Explanation of why the code is vulnerable
- Fix suggestion with before/after code examples
- Confidence level of the recommendation
- References to relevant security standards
Vulnerability Correlation
Deep Scans include automatic vulnerability correlation:
Deduplication
When multiple scanners detect the same issue (e.g., Semgrep and Bandit both flag a SQL injection), CodeStax merges them into a single finding instead of showing duplicates.
Attack Chain Detection
CodeStax identifies related vulnerabilities that could be chained together for greater impact. For example:
- An XSS vulnerability + a CSRF bypass = potential account takeover
- An open redirect + a session fixation = authentication bypass
- An SQL injection + missing encryption = data breach risk
Attack chains are highlighted with a risk multiplier that increases the severity of the combined findings.
Dashboard Overview
The main dashboard shows:
| Widget | Description |
|---|---|
| Total Scans | Count and completion status |
| Security Score | 0-100 compliance score |
| Issues Found | Total across all scans |
| Active Scans | Currently running/queued |
| Recent Scans | Last 6 scans with quick status |
| System Status | Scanner availability |
PDF Reports
Generate a downloadable PDF security report for any scan:
- Executive Summary — High-level overview for management
- Compliance Matrix — SOC 2 and ISO 27001 status mapping
- Detailed Findings — Every issue with severity, file location, and remediation
- Severity color-coding — Critical (red), High (orange), Medium (yellow) in the PDF