Skip to main content

​
Where findings appear

Findings from PR reviews appear in two places: as a comment on the GitHub pull request from battletest-security[bot], and in the run detail page in the BattleTest dashboard (linked from the PR comment). Findings from live scans appear only in the dashboard. Both types share the same lifecycle: Open → Dismissed or Resolved.

​
Dismiss a false positive

When a finding is not a real vulnerability — for example, a secret detected in a test fixture file, or an injection pattern in documentation — dismiss it so it doesn’t affect future risk scores.
1

Open the finding

Open the run detail page in the dashboard and click on the finding to expand it.
2

Dismiss

Click Dismiss.
3

Select a reason

Choose: False positive, Accepted risk, or Not applicable.
4

Add a note (optional)

Optionally add a note explaining the decision.
Dismissed findings are excluded from the risk score on subsequent scans of the same code path or endpoint. They’re also excluded from regression detection — a dismissed finding will not trigger a regression alert if it reappears.
Dismissals are recorded against your account, not the GitHub PR. If you connect a new repository or add a new target, you’ll need to re-dismiss findings there.

​
Mark a finding as resolved

You don’t need to mark findings as resolved manually. BattleTest detects resolution automatically: if the finding no longer appears in the next scan of the same PR branch or target, it’s automatically classified as Resolved. For live scan findings, trigger a new scan after deploying the fix. In the comparison view, the fixed finding will appear under Resolved in the scan diff. Resolved findings contribute to the regression detection baseline. If the same vulnerability pattern reappears in a future scan, it’s flagged as a regression — not a new finding — and the risk score includes a regression penalty.

​
View all open findings for a repository

1

Select repository

Go to Dashboard → Repositories and select a repository.
2

Open Findings tab

Click the Findings tab.
This shows all open findings across all PR runs for that repository, sorted by severity. Filter by severity, source (CVE, Secret, AI, etc.), and status.

​
View all open findings for a live target

1

Select environment

Go to Tests and select the environment.
2

Open Findings tab

Click the Findings tab.
This shows persistent and new findings across all scans of the target, with scan-over-scan comparison available on each finding.

​
Export findings

See how to export findings for an audit or SOC 2.