A finding is only as strong as what backs it. Security names the kind of evidence behind each finding, and only evidence with a trusted verification record can make a finding block a pull request, notify anyone, or count as confirmed.
The three kinds
| Evidence | Means | Verified by |
|---|---|---|
| Advisory match | A complete scan matched an installed package version to the affected range of a published advisory. | The scan itself: the scanner and its version, the configuration Coroid gave it, and the advisory with the time it was last changed. |
| Validated static finding | Code matches a vulnerable pattern. | A rule that passed calibration, or, for an issue an AI model raised, an independent check that re-derives the issue from the code at that commit. The check is a separate run, not the one that raised it. |
| Reproduced failure | A security failure was executed and observed. | A proof run in an isolated environment, re-run independently with the same result. Planned: Coroid does not run proofs yet. |
A verification record belongs to one commit. It does not carry over to the next one; the next scan observes again.
What each kind may do
- Dependency findings enforce on advisory matches.
- Secret and code rules enforce only with a detector version that passed calibration. See Protections and enforcement.
- Coroid Review's security claims and the audit's findings block or notify only once an independent check confirms them as a validated static finding.
Not confirmed yet
A finding without such evidence is listed as Not confirmed yet. It shows in Security, with what is known, and does nothing else: it does not fail a check, notify anyone, or count in Overview as confirmed. This is where an AI model's claim stays when the independent check could not confirm it, for example because the code that decides the issue is in another file.
An alert imported from GitHub that Coroid's own scans have not confirmed shows as Imported from GitHub, not confirmed yet, and is counted separately in Overview. It notifies and blocks only once Coroid's own scan confirms it. See GitHub permissions and the Coroid Security check.
Where to see it
A finding's page shows its evidence, which source produced it, and what verified it. Fix pull requests carry their evidence too: for a dependency, the advisories it fixes and the package inventory before and after the change. See Fix pull requests.