Reference D: Issue category routing

.Each issue category tab in the scan side panel presents a distinct detection type that demands a distinct investigation. Configurations and Package Integrity each present two tables. Remediation is performed from the Resolution tab of the issue side card; use this table for the prioritization model and the full remediation lifecycle of each category.

Tab	Table	Detection scope	First evidence to check	Resolution guide
Vulnerabilities	—	Known CVE vulnerabilities in open-source dependencies, including transitive dependencies; detections originate from the native SCA scanner, from ingested third-party CVE findings, or from both	Whether a fix version exists, whether the vulnerable package is reachable from application code, and which source produced the detection — read the Scanner field in the issue side panel, as described in Reference G: Scanner to issue category mapping	Software Composition Analysis (SCA) vulnerability issues
Configurations	IaC Misconfigurations	IaC misconfigurations in Terraform, CloudFormation, Kubernetes, and Helm templates	The specific resource block and attribute in the template, and whether the template is deployed	Infrastructure as Code (IaC) misconfiguration scanner
Configurations	CI/CD Risks	Insecure CI/CD pipeline configuration detected in the repository, such as an unpinned action, an over-permissioned workflow token, or a poisoned pipeline execution path	How the configuration is reachable by an attacker, and what the pipeline can access if compromised	CI/CD Risks
Secrets	—	Hardcoded credentials, API keys, and tokens in the working tree, and in commit history when Git History Scan is enabled	The validation status of the secret; a validated, active credential is a containment task with a rotation deadline, not a code-cleanup task	Secrets scans
Package Integrity	Licenses	License miscompliance in open-source dependencies	The license obligation the dependency imposes, and whether the obligation conflicts with how the software is distributed	License miscompliance issues
Package Integrity	Package Operational Risk	Operational risk in open-source dependencies, such as an unmaintained, deprecated, or outdated package	The operational risk rating of the package, and whether a maintained replacement exists	Package operational risks
Malicious Packages	—	Open-source dependencies matched against the malicious packages dataset — typosquatted names, backdoored libraries, and hijacked versions, covering direct and transitive dependencies; a malicious package carries no CVE, so vulnerability scanning does not detect it	Whether the package reached a deployed artifact, and whether the dependency is direct or transitive	Malicious packages

Note: License Miscompliance, Package Operational Risk, and Malicious Packages issues do not receive Urgency classification. Prioritize a Package Integrity issue by the license obligation, the operational risk rating, and the presence of associated CVE vulnerabilities. Every malicious package issue is raised at Critical severity, so severity does not order one against another — prioritize by deployment status first, then by dependency type. See Malicious packages issues.