Skip to content
Craftifact

Review vulnerability findings

How to use Craftifact's Findings view and vulnerability report API to review SBOM-backed vulnerability findings for a package artifact or OCI subject.

Use Findings when you need vulnerability context for one package artifact or OCI subject that already has an effective SBOM.

Quick path

  1. Open Craftifact and choose the relevant repository in Browse.
  2. Open the artifact, OCI tag, or OCI digest you want to review.
  3. In the detail panel, use the Vulnerabilities item in the Insights row when it is visible.
  4. If you are already in the subject-specific Dependencies view, use the View vulnerability findings action.
  5. Check the scan state and vulnerability database freshness before treating the result as final.
  6. Filter by priority, severity, target, or component text when the result set is large.
  7. If you have findings-management access, suppress selected findings only with a clear expiry and justification.

Start from artifact details

When you already know the artifact, OCI tag, or OCI digest, start in Browse. The detail panel shows subject-specific Insights when Craftifact has enough context for the selected item. Use Vulnerabilities there to open Findings -> Vulnerabilities directly for that subject. If you are reviewing dependencies first, open the subject-specific Dependencies view from the same detail panel and then use View vulnerability findings.

This avoids manual PURL lookup and keeps the findings scope tied to the exact artifact or image you opened.

Scope of this guide

This guide covers Findings -> Vulnerabilities. The same Findings area also contains Suppressions, Secrets, and Licenses; secret scanning is available on Starter with a 512 MiB source and extracted-data limit, and license results come from the selected subject’s SBOM.

Where findings come from

Vulnerability findings are derived from the effective SBOM for the selected subject. Craftifact uses Trivy-backed scanning for that SBOM and stores the resulting report.

The view is subject-scoped:

  • package artifact mode follows one artifact_id,
  • OCI mode follows one digest in one repository,
  • findings are not merged across several SBOM documents for the same subject.

Reading the state

The findings view can show more than ready results. Treat pending, failed, invalid, skipped, or stale states as signals that the result is not a complete clean bill.

Freshness badges live with the vulnerability findings because generated SBOMs, Trivy vulnerability data, and external priority feeds can become stale over time. If the page marks data as stale or unavailable, use it as current context for triage, not as proof that nothing changed upstream.

When scans run

Craftifact starts the initial scan when the SBOM is ready after upload or generation, then checks existing vulnerability reports for needed rescans once per day by default. Operators can change that periodic check with scheduler.vulnerability_rescan.interval in the instance configuration.

Priority signals

Craftifact assigns a vulnerability priority tier in addition to scanner severity. The tier combines scanner severity floors with CISA KEV and EPSS risk intelligence when those feeds are current.

Use the Filter controls to choose whether KEV and EPSS should influence priority scoring, sorting, filters, and tooltips. Those signal settings persist in the browser, while severity and environment filters remain scoped to the current page.

Priority filters are triage helpers. They do not change the underlying vulnerability report API schema, and they do not replace checking fixed-version and package context before making a release decision.

Suppressions

Suppressions are for documented triage decisions, not for hiding noise permanently. When you suppress findings, keep the scope as narrow as practical, set an expiry, and write a justification that another reviewer can understand later.

The findings:suppress permission controls suppression actions and detailed suppression management. Users with read access can review findings, but they may not be able to create, renew, or revoke suppressions.

API access

Automation can read the same subject-scoped vulnerability report through the SBOM vulnerability report API. Use that when a pipeline or external triage step needs the persisted report for one artifact or OCI digest.