Last updated: 28 October 2026

Example security report

This is an illustrative report, not an assessment of a customer project. The examples demonstrate the review workflow and do not claim confirmed exploitability.

Scope and limitations

Example project archive; dependency, secret, code-pattern and configuration checks. No production connection, active exploitation or business-logic testing. A scan cannot establish that an application is secure.

01 · Possible exposed credential

Priority: high · source: secret detection. A file matches a supported API-key pattern. Verify whether it is a live credential and who could access it. If exposed, revoke or rotate it, investigate use and remove it from the relevant history. A deleted string does not invalidate a credential.

02 · Dependency advisory

Priority: medium · source: dependency scan. A supported lockfile contains a package version covered by an advisory. Check the exact package, version, affected feature and available fixed version. Severity alone does not establish application exposure. Update, test and rescan.

03 · Unsafe command pattern

Priority: needs context · source: code rule. A command-execution pattern may allow untrusted input to reach a shell. Trace the input, consider safer argument-based APIs and add tests. A pattern match requires review before it is called a confirmed vulnerability.

Review and next steps

Assign an owner, verify each finding against evidence, apply and test agreed changes, then rescan. Record incomplete scanner coverage separately from a scan with no findings. AI explanations support this process and do not replace an engineer.