My findings
My findings is the engineer work queue for open misconfigurations and policy failures on repositories and stacks you can access. Run IaC scans from Security Insights, fix the infrastructure code, and track violations here until they clear. For org-wide posture, exceptions, and analytics, admins use the Governance Dashboard instead.
Who should use this page
| Audience | Use My findings when… |
|---|---|
| Engineers / members | You need to see and fix violations on stacks and repos in your day-to-day work. |
| Admins / governance owners | You want a focused violation list without leaving the security area; use Governance Dashboard for org-wide remediation and settings. |
| Viewers | You need read-only visibility into open violations in scope. |
Non-admins see an info banner: organization-wide policy packs, scan defaults, and compliance settings are managed by your administrator. You can still scan Git repositories and platform resources you have access to from Security Insights.
Open violations explorer
The Open violations panel uses the same violation explorer as the Governance Dashboard, tuned for engineers. IaC scan findings appear here after you run a repository or platform scan; policy evaluation results appear when assigned policies fail.
Filters and summaries
| Control | What it does |
|---|---|
| Filter by stack | Chip filters for stacks with open violations (up to eight shown). Click again to clear, or use Clear filter. |
| Policy summary chips | Top policies by violation count — quick context before drilling into rows. |
| Time window | Violations from the last 30 days (default query period). |
| Pagination | Page through results; change page size (10, 20, 50, or 100 rows). |
Violation table columns
| Column | Meaning |
|---|---|
| Policy | Policy name and violation message. |
| Resource | Resource address in IaC (monospace). |
| Severity | Critical, high, medium, or low. |
| Trigger | What produced the evaluation (e.g. scan, deployment gate, policy evaluation). |
| Status | Remediation status: OPEN, IN PROGRESS, or RESOLVED. |
Empty state
When there are no open violations for the selected period, the page shows No open violations with guidance to keep posture current.
Run IaC scan
Primary action — opens Security Insights on the IaC scans tab to scan Git repos or platform resources.
On the Governance Dashboard, admins see an additional Evaluate policies action in the empty state; My findings does not show that secondary action (engineers scan IaC instead).
Typical workflow
- Open My findings and review open violations, optionally filtering by stack.
- Identify the policy and resource address; open the corresponding repo or stack in your editor.
- Fix the IaC misconfiguration or policy failure in source code.
- Re-scan from Security Insights → IaC scans (Git live scan, Scan now, or platform on-demand scan).
- Retry deployment if a gate blocked PLAN or APPLY.
- Confirm the violation moves to RESOLVED or drops off the list after the next evaluation.
What you can do
- Filter and inspect violations on stacks and repos in your work queue.
- Jump to Security Insights to run new scans.
- Open the remediation center for tracking (shared with Governance Dashboard).
What you cannot do here
- Install org-wide policy packs or assign compliance frameworks.
- Change policy gate mode or live-scan defaults.
- Create or approve organization-wide policy exceptions.
- Run org-wide platform scans (reserved for org owner on Security Insights).
My findings vs Governance Dashboard
| My findings | Governance Dashboard |
|---|---|
Engineer-focused work queue at /security/findings | Org control center at /governance |
| Open violations table and scan shortcut | Violations, exceptions, remediation, posture, analytics, settings |
| Linked from Security Insights KPIs (non-admin) | Linked from Security Insights KPIs (admin) and connectors |
| No policy pack or gate configuration | Gate mode, live-scan defaults, evidence export, integrations |
Admins see a footer link to the Governance Dashboard for org-wide remediation, exceptions, and posture analytics. Do not disable deploy gates globally to clear a single stack unless leadership explicitly approves it.
How findings get here
- IaC scans (Security Insights) — Terraform, OpenTofu, Pulumi, CloudFormation, and secrets-in-code checks produce misconfiguration findings.
- Live scan — continuous evaluation on connected Git repositories surfaces new issues automatically.
- Policy evaluation — assigned policy packs add guardrails; failures become violations.
- Deploy gates — enforcing policies during PLAN/APPLY record violations when deployments are blocked or warned.
Built-in misconfiguration and secrets checks always run during scans; policy packs are optional but add organizational rules on top. Violations from scans and policy evaluation appear together in the Open violations table.
Permissions
| Permission / role | Typical access on My findings |
|---|---|
security:read | View My findings and the violations table (required for nav access). |
security:manage, policy:manage, or governance:manage | Act on findings — resolve, suppress, or update remediations (viewers stay read-only). |
governance:manage or org Admin/Owner | Same violation explorer with admin empty-state actions; full org tools on Governance Dashboard. |
| Viewers | Read-only access to violations in scope. |