Triage & decisions

Not every vulnerability that matches a component actually affects you. Triage is how you record that judgment — once, with justification, in a way an auditor will accept.

Finding decisions

A finding decision records the outcome of triaging a finding: what you decided, why, and when. Decisions are tracked per organization and show up in the Decisions view and the assurance log.

VEX assertions

VEX (Vulnerability Exploitability eXchange) states whether a vulnerability is exploitable in your context:

• Affected — it applies; remediate it.
• Not affected — with a justification (e.g. the vulnerable code path isn't reachable).
• Fixed — already remediated.
• Under investigation — triage in progress.

Manage assertions from the Decisions hub (the Decisions entry in the sidebar) — create them individually or in bulk, see which findings each one is suppressing, and catch assertions that are expiring soon. A not affected assertion communicates status downstream without deleting the underlying finding.

Exclusions

A finding exclusion removes a finding from your working set when it's genuinely not relevant (e.g. a test-only dependency). Exclusions are explicit and auditable — they don't silently disappear.

Applicability rules

Doing the above one finding at a time doesn't scale. Applicability rules let you express, once, which findings apply to your context, then govern them in bulk:

• Preview a rule before it takes effect.
• Approve / reject proposed rules.
• Review uncovered findings (not yet governed by any rule) and conflicts (where rules disagree), plus per-component overrides.

A scheduled governance job keeps rule coverage honest over time.

Next

Assurance & evidence turns these decisions into proof.