Overview
Issues, under Findings in the sidebar, lists the security findings in the repositories you can view. The page is shown to members with the View Repository permission. See Navigating ZeroPath for the sidebar. The page has two views:- Lanes view (the default) groups findings by status and then by priority. Each lane header states the rule that puts a finding in it.
- Board view shows the open workflow as columns. Dragging a card to another column changes the finding’s status.
Status groups
At the top of the page, a segmented control switches between three status groups:
The number beside each group is the workspace total for that group. It counts every category except Containers, with code findings from full scans only, and it follows the repository filter in the top bar. On a repository’s Issues tab it counts that repository’s default branch. The search box, category tabs, Score filter, scan source and other page filters do not change these numbers. When a total cannot be read, the group shows a dash instead of a number, with the tooltip Count unavailable or Took too long to count.
When you set a page filter, a results line under the toolbar counts the findings that match, for example “12 open issues match”, with Clear filters beside it.
If the status filter selects statuses that do not form one of the three groups, for example after you apply a saved rule that selects only Needs review, no group is highlighted and Custom statuses appears beside the control. The findings then appear as one list instead of lanes. Each row in that list carries a tag naming its lane, and the tag’s tooltip gives the exact reason, for example “High severity, known to be exploited in the wild (KEV).”
The status groups are hidden on the Board view, because the board’s columns are the statuses.
Lanes view
Each status group splits its findings into lanes:
Findings with the Informational status belong to none of the three groups.
How open findings are placed
ZeroPath places each open finding (Needs review or Backlog) in exactly one of the three open lanes, checking them in this order:- Fix now: the finding’s CVSS severity is High or Critical (7.0 or higher on the 0 to 10 scale), and it has at least one piece of exploit evidence. See Fix now.
- Needs decision: otherwise, the finding is confirmed exploitable at any severity, or it is Critical (9.0 or higher) and has not been ruled out. “Confirmed exploitable” means an agent, Runtime Validation or a person confirmed it.
- Lower priority: every other open finding. This includes High findings with no exploit evidence and no confirmation, findings with no severity, and Critical findings an agent ruled out.
Rows
Lane rows have the columns Severity, Finding, Evidence, Status and SLA:- Severity shows the CVSS severity from 0 to 10 with a four-bar glyph. Its tooltip reads “Severity (0–10), before confidence weighting”. This is not the ZeroPath score.
- Finding shows the title, repository and file. Hover it to see the class, branch, detection date and composite score.
- Evidence lists the exploit evidence chips (Runtime confirmed, Known exploited, Verified live, Likely exploitable, Exposed) and the validation chips: Validated for a finding confirmed by an agent, Runtime Validation or a person, Validated before tracking for a finding confirmed before ZeroPath recorded how, and Couldn’t validate when an agent examined it without reaching a verdict. A dependency finding matched only by its version shows Known vulnerable version.
- Status shows the status, the assignee (or Unassigned while Reviewing), the end date of an accepted risk as “Until” and a date, and any linked ticket key. See Linked tickets.
- SLA shows how long is left before the finding’s SLA deadline.
Lane headers, paging and drill-down
Lower priority, Non-exploitable, False positive and Accepted risk start collapsed. Click a lane header to expand or collapse it. Your browser remembers your choice. A lane header can also show:- “N overdue” when findings in the lane are past their SLA deadline.
- “Oldest N days” on Needs decision, the age of its oldest finding.
- “N critical · M high inside” while the lane’s rows are hidden, counted by CVSS severity.
- The lane header stays pinned at the top with a breadcrumb. Click the first breadcrumb item (the group name, such as Open, or Board when you came from the board) to go back.
- The group’s other lanes stay on screen as one-line headers with their counts. Click one to open that lane instead.
- The browser’s Back and Forward buttons and a page reload keep the lane open.
Sorting
Sort orders the rows within each lane. The default is Priority. The other options are Score, Title, Repository, Class, File, Detected and Patchability. When you sort by Score, Class, Detected or Patchability, each row shows the value it is sorted by.Fix now
Fix now is the first lane of the Open group. An open finding is in Fix now when both of these hold:- Its CVSS severity is High or Critical: 7.0 or higher on the 0 to 10 severity scale. The lane reads severity, not the composite ZeroPath score.
- It has at least one piece of exploit evidence:
The Fix now column on the Repositories page counts the findings in this lane.
The name “Fix Now” also appears on two saved filter presets in the filter rules menu, and they select different findings from the Fix now lane:
- Fix Now — Code: status Needs review, type SAST or Logic, scan type Full Scan, Runtime Validation verdict Confirmed with Runtime Setup Default setup, and CVSS 4.0 Attack Vector Network, Privileges Required None and User Interaction None.
- Fix Now — Dependencies: status Needs review, type SCA, Reachability Likely Exploitable, and the same three CVSS 4.0 conditions.
Board view
The board shows the open workflow as four columns, in this order: Needs review, Backlog, Reviewing and Patching. Each column shows a count and loads more cards with Show N more. The Needs review column has a Needs review validation selector:- All
- Confirmed exploitable: findings an agent, Runtime Validation or a person confirmed.
- Couldn’t validate: findings an agent examined without reaching a verdict.
- Not examined: every other finding in the column.
Moving a card
Drag a card to another column, or focus a card and press M to open its Move to menu. Either way changes the finding’s status.- Moving a finding to Patching needs a generated patch. Otherwise the target shows “Needs a generated patch first”.
- Moving an unassigned finding to Reviewing assigns it to you, and the confirmation reads “Moved to Reviewing · assigned to you”. This applies to members of the organization; an MSP reviewer moves the finding without being assigned.
- If someone else changed the finding after you loaded it, the move is refused and ZeroPath asks you to review its current state.
Close as
Beside the columns, Close as lists the closing statuses as drop targets, each with a count, a note and a View button that opens that closed lane:
While you drag a card, a target you can use reads Drop to close, and a target you cannot use is dimmed with the reason. Dropping a card on a target opens a dialog for the reason before the move is made:
- Resolved and Non-exploitable take an optional reason.
- False positive takes a reason, which is required when your team holds the Require Context for False Positives permission.
- Accepted risk asks How long is this risk accepted? with two choices and no default. Until reopened keeps the risk accepted until someone reopens the finding. Until a date asks for an Expiration date and time in your local time zone. Accept Risk stays disabled until you choose. A reason is optional.
Accepted risk expiry
When an accepted risk reaches its expiration date, ZeroPath reopens the finding to Needs review. If the finding has since been fixed, is no longer detected, was marked a false positive or was judged not exploitable, it closes with that status instead. The change appears in the finding’s History credited to ZeroPath risk acceptance expiry, and the usual status change notifications are sent. Accepted risk rows in the Lanes view show the date the acceptance ends.Undo
After each move, a confirmation such as “Moved to Backlog” or “Closed as Resolved” offers Undo for 6 seconds. The countdown pauses while your pointer is over the confirmation or focus is inside it. Only the person who made the move can undo it. Undo restores the finding’s status; changes the move already made elsewhere, such as an update to a linked ticket, can remain. A close also offers View, which opens the closed lane the finding moved to.Who can move a finding
Each move is checked against your permissions on the finding’s repository. You need the permission for the target status and, when the finding is in certain states, the permission to move it out of that state:
Targets you cannot use show “You don’t have permission to move this issue”. See Teams & Permissions for how permissions are granted.
ZeroPath score
Each finding with a severity has the composite ZeroPath score, shown as Score in the app. The score is the finding’s severity (the CVSS base score, 0 to 10) multiplied by the agent’s confidence (0 to 10), so it runs from 0 to 100. The score does not use exploit evidence. EPSS, KEV, dependency reachability, Runtime Validation and Wiz exposure do not change it. That evidence decides the Fix now lane instead. The score falls into one of five bands:
A finding with no severity has no score and shows Unassessed.
A finding no agent has assessed has no confidence, and its severity is multiplied by 1. Its score therefore tops out at 10, which puts it in the Info band even when its CVSS severity is High or Critical.
Where the score appears
- Score filter: a menu of the five bands on the Issues page and the Scans page. Every band is selected by default. When you deselect some, a badge shows how many bands are selected.
- Score sort option on the Issues page.
- The row’s hover text, as “Composite score: N”.
- The issue header, as ” / 100”. Its tooltip shows “Composite score: / 100 · ”, then the severity out of 10 and the confidence out of 10.
- The issue’s Details tab, as Score, Severity and Confidence tiles.
Score and severity
The score and the CVSS severity are separate scales with similar band names:
The issue header shows the score next to the CVSS severity label, so a finding no agent assessed with CVSS 9.8 reads “10 / 100” next to “Critical”, while its tooltip places the score in the Info band. Selecting only the Critical and High bands in the Score filter hides every finding no agent has assessed, whatever its CVSS severity.
The header rounds the score to a whole number, and the Score filter compares the exact value, so a score shown as 90 can fall in the High band of the filter.
In saved filter rules, the Severity field (Critical, High, Medium, Low, Info) filters by score band, the same as the Score filter. Lane rows show CVSS severity. A rule with Severity set to High therefore matches findings in the High score band, not findings with a CVSS severity of High.
Global and repository Issues views
The Issues page and every repository’s Issues tab show the same view: lanes, board, the Dependencies view, status totals, exports and bulk actions. They differ in their scope controls. On the Issues page, the toolbar has:- Repositories, a picker to Select repositories and branches. Its badge reads All when every repository is selected.
- A scan source menu with All (every full scan and PR scan), Full Scans (the default) and Latest PR Scans, plus a list of specific pull request scans.
- Applications, to narrow the view to applications in your repositories.
- Branch: followed by the selected branch. The menu has Search branch, All branches and the repository’s branches. It appears for repositories connected to a version control provider, not for uploaded repositories.
- Scan history, which lists finished scans as “Full scan” or “PR scan” with their date, branch and commit. Load older scans loads more. Choosing a scan shows the findings of that scan, and the branch label reads the scan’s branch.
- The same scan source menu as the Issues page.
Dependencies tab
The Dependencies tab groups dependency findings By package, sorted by the highest EPSS score and then by CVSS. It has:- A Package, CVE or GHSA search.
- Quick filters with counts: Known exploited, Ransomware, EPSS over 10%, Reachable and Fix available.
- An Exploit probability by severity chart that plots CVSS against EPSS, with a count of advisories at CVSS ≥ 7 · EPSS ≥ 10%. That count is a separate threshold from the Fix now lane, and its tooltip says so.
- Summary rows: the number of advisories in the selected status group, Reachable or needs review, Likely exploitable, actively threatened (reachable, with EPSS 1% or higher or KEV) and Known exploited.
- An Upgrade button on each package, which proposes an upgrade to the nearest fixed release for supported ecosystems.
Issue detail and issue panel
Click a finding to open it in the issue panel. Open full page opens the same finding on its own page.Header
The header shows:- The severity bars, the score as ” / 100”, the CVSS severity label and the finding’s category. See ZeroPath score.
- The status menu, which shows the group and status, for example “Open / Needs review”. Its sections are In progress (Mark as reviewing, Mark as patching), Open (Move to backlog, and Reopen issue for an accepted risk) and Close as (Mark as resolved, Accept risk, and False positive or True positive). An option you cannot use shows the reason under it. To mark a finding Non-exploitable, use the board’s Close as targets.
- View code, which opens the affected code. In the issue panel it is in the More actions menu.
- One primary action that depends on where the fix stands, such as Generate patch, Approve patch, View PR, Choose a patch or Review package upgrade.
- More actions, with Copy issue link, View source PR (findings from a PR scan), Export to Jira and Export to Linear (when the integration is connected, the finding has no ticket in it yet, and you hold Create Jira Tickets or Create Linear Tickets), Export report (.docx), Unassign (when the finding has an assignee) and Reinvestigate. Reinvestigate needs the Close Issues permission, because a new verdict can close the finding.
Tabs
On a wide full page, Details and Assistant appear in a side panel instead of as tabs. Hide assistant and Show assistant close and reopen it.
In the issue panel, press 1 for Overview, 2 for Fix, 3 for History filtered to status changes, 4 for History filtered to detections and 5 for Assistant.
Linked tickets
When a finding is linked to a Jira or Linear ticket, its ticket key, such as SEC-12, appears under the status on its row and on the metadata line of its board card. The key opens the ticket. Its tooltip says the ticket status is not synced, for example “Jira SEC-12. Status is not synced from Jira; open the ticket to see it.”, so open the ticket to see where it stands. A key shows without a link when no ticket link was recorded, and a Linear ticket without a readable key shows as “Linear”. See Jira and Linear.History
The History tab shows one timeline of the finding’s status changes and scan detections. Filter it with All, Status changes or Detections. Long reasons collapse behind Show more. Each status change shows who or what made it:- Automatic changes name the ZeroPath job that made them, such as ZeroPath Reinvestigation, ZeroPath rescan agent, ZeroPath runtime validation, ZeroPath Patch Bot, ZeroPath risk acceptance expiry or ZeroPath Scanner.
- Changes made by closing the linked ticket name the ticket, such as “Jira · SEC-12”, or “Linear” when no key was sent.
- Other changes show the name recorded with the change, or Unknown actor when none was recorded.