Triage
Findings live on the project, with a note of which branch they were seen on. A won't-fix on main stays a won't-fix on the next PR. "Show only new issues on this PR" is a first-class view.
Statuses
| Status | Meaning | Still open? | Blocks the PR gate? |
|---|---|---|---|
new | Just discovered | yes | yes |
triaged | Looked at, not decided | yes | yes |
accepted | Follow-up later / accepted risk | yes | no |
needs_retest | Ready for a targeted retest | yes | yes |
still_vulnerable | Retest saw it again | yes | yes |
fixed | Gone, or a covered retest confirmed it | no | no |
false_positive | Not a real issue (--reason required) | no | no |
wont_fix | Accepted risk | yes | no |
accepted and wont_fix stay on the dashboard (open) but drop out of actionable, so gate and wait stop blocking. That is how an agent loop can converge after a risk decision.
Every change records who did it.
From the CLI
thespider-agent findings triage 501 --status triaged --note "reviewing this sprint"
thespider-agent findings triage 501 --status accepted --reason "compensating control in the WAF"
thespider-agent findings triage 501 --status false_positive --reason "test fixture, not shipped"
thespider-agent findings triage 501 --status fixed --commit 9f3c1ab
--status takes the eight rows above. open / closed / actionable are filters, not statuses. --commit is for fixed. thespider-agent refine records proposed-fix commits as needs_retest plus commits on the same endpoint. --decider defaults to thespider-agent@<host> so the history timeline is never "No decider."
New on a PR
The gate reports open findings whose first sighting is this PR branch and, for incrementals, whose files overlap changed_paths. Two common false "new"s:
- A rename may or may not de-duplicate onto the old finding.
- A model that never reported an old issue on
maincan look new on the PR. A reasonably fresh full scan of the default branch helps.
Duplicates attach to one canonical finding during ingest. There is no manual merge button in the UI or API today.
Model text is untrusted: the UI renders it as text, never as HTML. Export JSON downloads the filtered set.