> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/references/reference-d-issue-category-routing.md). # Reference D: Issue category routing .Each issue category tab in the scan side panel presents a distinct detection type that demands a distinct investigation. **Configurations** and **Package Integrity** each present two tables. Remediation is performed from the **Resolution** tab of the issue side card; use this table for the prioritization model and the full remediation lifecycle of each category. | Tab | Table | Detection scope | First evidence to check | Resolution guide | | ---------------------- | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Vulnerabilities** | — | Known CVE vulnerabilities in open-source dependencies, including transitive dependencies; detections originate from the native SCA scanner, from ingested third-party CVE findings, or from both | Whether a fix version exists, whether the vulnerable package is reachable from application code, and which source produced the detection — read the **Scanner** field in the issue side panel, as described in [Reference G: Scanner to issue category mapping](/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/references/reference-g-scanner-to-issue-category-mapping.md) | [Software Composition Analysis (SCA) vulnerability issues](/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/software-composition-analysis-sca-vulnerability-issues.md) | | **Configurations** | **IaC Misconfigurations** | IaC misconfigurations in Terraform, CloudFormation, Kubernetes, and Helm templates | The specific resource block and attribute in the template, and whether the template is deployed | [Infrastructure as Code (IaC) misconfiguration scanner](/application-security/code-security/code-security-scanners/infrastructure-as-code-iac-misconfiguration-scanner.md) | | **Configurations** | **CI/CD Risks** | Insecure CI/CD pipeline configuration detected in the repository, such as an unpinned action, an over-permissioned workflow token, or a poisoned pipeline execution path | How the configuration is reachable by an attacker, and what the pipeline can access if compromised | [CI/CD Risks](/application-security/software-supply-chain-security/risk-and-remediation/cicd-risks.md) | | **Secrets** | — | Hardcoded credentials, API keys, and tokens in the working tree, and in commit history when Git History Scan is enabled | The validation status of the secret; a validated, active credential is a containment task with a rotation deadline, not a code-cleanup task | [Secrets scans](/application-security/code-security/code-security-scanners/secrets-scans.md) | | **Package Integrity** | **Licenses** | License miscompliance in open-source dependencies | The license obligation the dependency imposes, and whether the obligation conflicts with how the software is distributed | [License miscompliance issues](/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/license-miscompliance-issues.md) | | **Package Integrity** | **Package Operational Risk** | Operational risk in open-source dependencies, such as an unmaintained, deprecated, or outdated package | The operational risk rating of the package, and whether a maintained replacement exists | [Package operational risks](/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/package-operational-risk-scanner.md) | | **Malicious Packages** | — | Open-source dependencies matched against the malicious packages dataset — typosquatted names, backdoored libraries, and hijacked versions, covering direct and transitive dependencies; a malicious package carries no CVE, so vulnerability scanning does not detect it | Whether the package reached a deployed artifact, and whether the dependency is direct or transitive | [Malicious packages](/application-security/software-supply-chain-security/risk-and-remediation/malicious-packages.md) | > **Note:** License Miscompliance, Package Operational Risk, and Malicious Packages issues do not receive Urgency classification. Prioritize a Package Integrity issue by the license obligation, the operational risk rating, and the presence of associated CVE vulnerabilities. Every malicious package issue is raised at Critical severity, so severity does not order one against another — prioritize by deployment status first, then by dependency type. See [Malicious packages issues](/application-security/software-supply-chain-security/risk-and-remediation/malicious-packages.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/references/reference-d-issue-category-routing.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.