Reading a scan report
Every finished scan has an Intelligence Report. It answers three questions: what your code depends on, which of those dependencies are vulnerable, and which vulnerabilities to fix first.
Report layout
From top to bottom, the report has:
- Header: the repository name, when the analysis finished, and counts of files analysed (AST Nodes), import links (Edges) and Dependencies.
- Four summary cards:
- Risk Score: the highest risk score of any finding, out of 100. See Risk score.
- Confirmed CVE Vulnerabilities: the number of vulnerabilities found, with how many are Critical, High, Medium and Low.
- Vulnerability Blast Radius: how many of your source files call a vulnerable function.
- Resolved Dependencies: the total number of packages found.
- Dependency map: an interactive graph of files and packages.
- Three tabs: Vulnerability Findings, All Dependencies and Risk Score, each with its own export.
Dependency map
The Dependency Architecture graph shows your source files on the left and the packages they import on the right. Arrows point from the file that imports to the package it imports.
Colours and markers
| Marker | Meaning |
|---|---|
| Internal Source File | A file in your repository. Test files are marked "test". |
| External Package | A package your code imports, with its ecosystem and version when known. |
| Vulnerable Dependency | A package with at least one known vulnerability. Marked VULN and ALERT. |
| Red dashed arrow | An import that leads to a vulnerable package. |
Controls
| Control | What it does |
|---|---|
| Focused Explorer | A clean view. Files show a "deps" count; click it to expand that file's dependencies. |
| Full Graph | Everything at once, to see the full blast radius. |
| N vulnerable · Focus | Jumps to the paths that lead to vulnerable packages. |
| All / Vulns / Files / Packages | Filters which nodes are shown. |
| Search node (⌘K) | Finds a file or package by name. |
| Standalone (N) | Shows files that import nothing, kept on a separate shelf. |
| Collapse (N) | Closes every expanded node. |
| + / − / fit / full screen | Zoom, fit the whole graph on screen, or go full screen. |
Inspecting a file or package
Click any node to open the inspector on the right. It shows:
- Security Findings: the vulnerabilities on that package, with CVSS scores.
- Direct Dependencies and Imported By: what it imports and what imports it. Click an entry to jump to it, or inspect the link to see the exact functions and line numbers involved.
- Center in Canvas and Expand/Collapse to move around the graph.
Marking files internal or external
For your own source files, the inspector has an Exposure setting: internal or external. Mark a file external when it handles requests from the internet, such as an API route or a public web handler. Vulnerabilities reachable from external files get a higher risk score.
Vulnerabilities
The Vulnerability Findings tab lists every vulnerability found, one row per advisory and package.
| Column | Meaning |
|---|---|
| CVE / Advisory ID | The CVE number and the advisory it comes from, such as a GitHub (GHSA) advisory. |
| Affected Package | The package and its ecosystem, such as npm or PyPI. |
| Severity | Critical, High, Medium or Low, based on the CVSS score. |
| Blast Radius | How many of your source files call the vulnerable code, or "Not directly reachable". |
| Recommended Fix | The version that fixes it, or "No fix available". |
| CVSS Score | The industry-standard severity score, 0 to 10. |
| Risk Score | Our priority score, 0 to 100. See Risk score below. |
| Action | Fix opens the recommendations page; Advisory opens the advisory on GitHub. |
Confirmed and potential matches
When your manifest pins an exact version, a vulnerability is confirmed: that version is known to be affected. When it only gives a range, such as ^1.2, the vulnerability is potential: some versions in the range are affected. Pin exact versions, or use a lock file, for more precise results.
Exports
- Export CSV on this tab downloads every finding, including EPSS and KEV data, reachability, the vulnerable functions, the files that reach each one, fixes and CWE categories.
- The All Dependencies tab lists every package with its version, ecosystem, scope and the manifest it came from. Use Search packages… to filter it and Export CSV to download it.
- Generate SBOM, on the same tab, builds a software bill of materials in CycloneDX JSON, with licence details. Click Download SBOM when it is ready.
Risk score
CVSS says how bad a vulnerability is in general. The risk score says how urgent it is in your repository. It is a weighted score from 0 to 100, calculated from these factors:
| Factor | What it measures |
|---|---|
| CVSS Score | The CVSS severity score. |
| Exploit | How likely exploitation is: the EPSS likelihood, and whether CISA lists it as exploited in the wild. |
| Exposure | Whether the code that uses the package is marked external (internet-facing) or internal. |
| Production | Whether you chose Production or Staging when starting the scan. Production scores higher. |
| Reachability | Whether your code calls the vulnerable functions. See the table below. |
| Fix | Whether a fixed version is available. |
For npm packages, the score is also adjusted by comparing the type of vulnerability (its CWE category) with the kind of package it affects.
Bands
| Score | Band |
|---|---|
| 80–100 | Critical |
| 60–79 | High |
| 25–59 | Medium |
| 0–24 | Low |
Reachability
| Result | Meaning |
|---|---|
| reachable | Your code calls a function the advisory names as vulnerable. |
| unreachable | Your code does not call a vulnerable function |
| unconfirmed | We know some vulnerable functions and none matched, but the list may be incomplete, so it is still treated as a risk. |
| unknown | The advisory names no functions, so any code that imports the package is treated as exposed. |
The Risk Score tab lists every finding from highest to lowest score, with each factor in its own column. Click a row to see the weights and raw values behind its score. Export CSV downloads the full breakdown.
Recommendations
Click Fix on a finding to open its recommendations page. It covers the package as a whole, so you can fix all of its vulnerabilities at once.
- Recommended fix: the version to upgrade to, taken from the advisories, or No fix published. A Version range label means your manifest allows a range rather than one version.
- Vulnerabilities: each advisory, with its severity, its exploit likelihood (EPSS), an Exploited in the wild label when CISA lists it, and Your code calls the affected functions when it is reachable.
- Where your code uses it: each file that imports the package, marked by whether it calls an affected function or only imports the package.
- Alternative packages: AI suggestions for replacing the package.
Getting alternative packages
- 1Add your own AI key in Settings → AI Provider (Claude, OpenAI, Gemini or a compatible provider).
- 2On the recommendations page, click Find alternative packages.
- 3Review the suggestions. Each says how hard the move is (Easy migration, Moderate migration or Large migration). Suggestions are checked against the package registry: ones that don't exist are removed, and ones the registry couldn't confirm are labelled Unverified. Check those exist before installing them.