> ## Documentation Index
> Fetch the complete documentation index at: https://docs.snapsec.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Findings & Vulnerabilities

> The lifecycle, status states, and data model of security findings in Snapsec.

Snapsec distinguishes between a **Finding** (an observation made during a specific scan or assessment) and a **Vulnerability** (a validated, persistent security defect attached to an asset).

***

## Finding Lifecycle States

```mermaid theme={null}
stateDiagram-v2
    [*] --> Active: Discovered by Scanner / Pentest
    Active --> In_Progress: Assigned to Engineer
    Active --> False_Positive: Suppressed by Rule / Review
    Active --> Risk_Accepted: Approved Business Exception
    In_Progress --> Resolved: Fix Deployed
    Resolved --> Verified_Closed: Retest Confirms Remediation
    Resolved --> Active: Retest Detects Regressed Issue
```

### State Definitions

* **Active**: Newly detected issue confirmed open and requiring remediation.
* **In Progress**: Acknowledged by the technical owner; actively tracked in Jira/ticketing.
* **Risk Accepted**: Valid finding where the business approves temporary exception.
* **Suppressed / False Positive**: Excluded based on custom regex or rule suppression.
* **Resolved**: Developer marked as fixed; pending verification.
* **Closed (Verified)**: Successfully re-tested by scanner or AI pentest with verified proof of fix.

***

## Finding Anatomy

Each finding record contains:

* **Canonical Definition**: Title, CVE ID, CWE classification, CVSS v3.1 vector.
* **Contextual TrueRisk™ Score**: Computed organization-specific risk.
* **Proof-of-Concept Evidence**: Verifiable HTTP request/response, injected commands, or logs.
* **Remediation Advisory**: Exact code diff, framework-specific guidance, or config patch.
* **SLA Countdown**: Days remaining before breach violation.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.