Reference E: Issue category routing

Each issue category tab presents a distinct detection type. Use this table to route from a pull request scan result to the guide that owns resolution.

Each issue category tab in the scan side panel presents a distinct detection type. The Package Integrity tab presents two tables, and each table routes to its own resolution guide. Use this table to route from the pull request scan result to the guide that owns resolution.

Tab	Table	Detection scope	First evidence to check	Resolution guide
Vulnerabilities	—	Known CVE vulnerabilities in open-source dependencies introduced or modified by the pull request, including transitive dependencies.	Whether a fix version exists for the package the pull request introduces.	Investigate, prioritize, and remediate SCA CVE issues
Configurations	—	IaC misconfigurations in Terraform, CloudFormation, Kubernetes, and Helm templates changed by the pull request.	The specific resource block and attribute in the changed template.	Investigate, prioritize, and remediate IaC misconfiguration issues
Secrets	—	Hardcoded credentials, API keys, and tokens introduced by the pull request.	The validation status of the secret. A validated, active credential requires rotation on a deadline.	Investigate, prioritize, and remediate secrets issues
Package Integrity	Licenses	License miscompliance for packages the pull request adds or changes.	The license obligation the added dependency imposes, and whether the obligation conflicts with how the software is distributed.	Investigate, prioritize, and remediate license miscompliance issues
Package Integrity	Package Operational Risk	Operational risk for packages the pull request adds or changes, such as an unmaintained, deprecated, or outdated package.	The operational risk rating of the added package, and whether a maintained replacement exists.	Investigate, prioritize, and remediate package operational risk issues
Malicious Packages	—	Packages the pull request adds that match the malicious packages dataset — typosquatted names, backdoored libraries, and hijacked versions, covering direct and transitive dependencies. A malicious package carries no CVE, so vulnerability scanning does not detect it.	Whether the dependency is direct or transitive, and which manifest change introduced it.	Investigate, prioritize, and remediate malicious package issues

Note: A malicious package is raised at Critical severity in every case, so severity does not order one malicious package issue against another. A pull request is the last stage at which a malicious package is removed before the package reaches a protected branch. See Malicious packages issues.