Triage & decisions

Not every vulnerability that matches a component actually affects you. Triage is how you record that judgment — once, with justification, in a way an auditor will accept. In TraceGuard a triage decision is a VEX decision.

The Decisions hub

Decisions in the sidebar holds the review queues and every decision made:

Tab	What it lists
Needs review	Open Critical and High findings in current BOMs that no VEX decision settles yet.
New criticals	Critical or CISA KEV findings first seen in the last 7 days, not yet settled.
Expiring	VEX decisions that expire within 30 days.
Suppressed	VEX decisions that mark a vulnerability not affected or fixed.
All decisions	Every VEX decision.
Reintroduced	Findings that were fixed and are detected again.

You triage a finding with Triage on the BOM's Vulnerabilities tab, on the Findings page (one decision for several projects at once), or from a finding's timeline. Recording a VEX decision needs the VEX permissions; owners and admins have them by default.

VEX decisions

VEX (Vulnerability Exploitability eXchange) states whether a vulnerability affects your product:

Decision	What you add	Leaves Needs review?	Still counted as open?
Not affected	A justification, such as Vulnerable code not in execute path, and details. Choose Other when none of the standard reasons fits and say why in the detail (at least 10 characters): that text is exported in place of the standard reason.	Yes	No
Affected	A response: Fix planned (update), Roll back to an unaffected version, Workaround available, Won't fix: risk accepted or Can't fix: no remediation available.	Yes	Yes
Fixed	Details, if you like.	Yes	No
Under investigation	Details, if you like.	No	Yes

Under investigation is recorded and exported, but keeps the finding in Needs review on purpose: an unassessed Critical or High should not disappear from the queue.

A decision applies to one project or to the whole organization, and to one package or to every package with that vulnerability. It is tied to the project, vulnerability and package, not to a scan, so it still applies after a rescan. You can give it an expiry date; after that date it stops applying and the finding comes back to Needs review.

Accepted risk

Affected with Won't fix: risk accepted or Can't fix: no remediation available accepts the risk instead of removing it. It needs:

a project — an accepted risk is a decision about one product, never organization-wide;
a reason of at least 10 characters;
a review date (Review by): 180 days from today unless you choose another, and at most two years from today.

The vulnerability stays counted as open. The finding leaves Needs review until the review date, then comes back for a new decision. Members who may change VEX decisions get an in-app notification 14 days before the date (Settings → Notifications → VEX decisions due for review).

History and export

Every VEX decision keeps a history of who changed what, written by the database. Download your organization's decisions as an OpenVEX document from the Decisions page; evidence bundles include them too.

app.traceguard.io/…/decisions

minimist1.2.0

CVE-2020-7598 · prototype pollution

Medium

Exploitability

Justification

Notes (optional)

This finding will be recorded as Not affected — vulnerable code not in execute path.

Open in app →

Exclusions

An exclusion is the other way a finding leaves the queue. In the Triage dialog on a BOM's Vulnerabilities tab, choose Show legacy immutable exclusion option, then Not applicable (immutable).

It needs a reason, and applies to one project or the whole organization.
It cannot be edited or removed. To change it, create a new one or let it expire.
It applies from the next scan of each BOM: the finding is then marked Excluded and left out of the queues and the totals.
Creating one needs the permission to suppress findings; owners and admins have it by default.

Prefer Not affected with a clear justification over an exclusion when the finding is real but does not affect you. A VEX decision can be corrected later, is exported in VEX documents, and carries more weight in an evidence bundle.

Finding decisions (retired)

Before 18 October 2026 TraceGuard also had separate finding decisions. Queues and exports never read them, so they were retired: the API answers new writes with 410 finding_decisions_retired, and the MCP tools record_finding_decision and list_finding_decisions were removed. Decisions recorded earlier stay readable. Record new decisions as VEX.

Applicability rules

Applicability rules work earlier, when a BOM is scanned. They give parts without a package URL an identity the scanner can match, usually a CPE, and an optional version range can mark findings Out of scope. See Applicability rules and CPEs.

Assurance & evidence turns these decisions into proof.