Security Insights and findings

Routes: /security/insights   /security/findings Who: All signed-in org members with security:read.
i Admins see extra connectors and org-wide actions.

Security Insights is the operations view: scans, vulnerabilities, SBOMs, executive risk snapshot, and live IaC scan status. Governance Dashboard is the policy posture view. Use both; they are not duplicates.

Security Insights

Overview tab

Shows organization security score/grade, executive snapshot, attack-surface summary, open remediations, recent timeline events, and recommendations.

Typical actions:

♢

Read the score

Read the score and severity mix before a leadership review.

✣

Follow recommendations

Follow recommendations (enable live scan, install a pack, close critical findings).

↗

Jump to key areas

Jump to Governance Dashboard, Policy Library, or Policy Packs via the connector cards.

♧

Stay updated

Review timeline events and stay informed about security changes.

Scans tab

Embedded security operations: Scans, CVE Database, and SBOM.

Surface What you can do
Scans Start or review IaC / image / config scans; inspect findings.
CVE Database Browse known CVEs; sync live data from OSV (SEED vs OSV source).
SBOM Inspect software bills of materials and component inventory.
✓ Live scan per Git repository
  • Enable live scan on connected repos so new IaC is evaluated without a manual click every time.
  • Open /security/insights?tab=scans (also used after Governance live-scan bookmarks).
  • Org default for new repos is set under Governance Dashboard → Settings.

Scan engines in the product include IaC-oriented checks (Terraform, OpenTofu, Pulumi, CloudFormation, secrets-in-code). Results become findings and, when policies are assigned, policy violations.

Quick actions

From the Insights hero/quick-actions:

⌕

Run a scan

Open the Scans tab and run an IaC scan.

☷

My findings

Open My findings for a personal work queue.

▱

Policy Packs

Admins: open Policy Packs.

▤

Policy Library

Admins: open Policy Library.

⚙

Settings & eval

Admins: open live-scan settings or policy evaluation.

My findings

Route: /security/findings

This is the engineer work queue: open misconfigurations and policy failures on repositories and stacks you can access. It is scoped by resource visibility, not the full org (unless you are OWNER/ADMIN).

What you can do

  • Filter and inspect violations that belong to your stacks/repos.
  • Open a finding, fix the IaC, and re-scan.
  • Start a new scan via Security Insights → Scans.

What you cannot do here

  • Install org-wide policy packs or change compliance frameworks.
  • Change gate mode or live-scan defaults.
  • Approve exceptions for the whole organization.
⚠

Non-admins see a banner that organization-wide packs and compliance are managed by an administrator.

How scans relate to deploy gates

  1. A scan or policy evaluation produces findings / violations.
  2. If the policy is enforcing and the org (or environment) gate is Enforce, PLAN/APPLY can block.
  3. Advisory mode still records the same issues so you can fix them without stopping the pipeline.
i

Fix the code, re-scan, then retry the deployment. Do not disable the gate globally to unblock one stack unless that is an explicit leadership decision.

CVE sync

Admins with security:manage (or equivalent governance manage) can sync CVEs from OSV. The CVE table labels the data source so seed/demo rows are distinguishable from live feed rows.