Investigate repository assets
Select a repository row in the table to open its side panel. This provides a consolidated workspace for investigating repository assets and remediating associated security issues without navigating away from the asset inventory.
Ask the AppSec agentic assistant
From the Repositories table, right-click a repository → Open in Agentic Assistant → select Application Security from the agents menu, and query repository-specific insights (for example, scan coverage, risk posture, or gaps).
Additionally, you can click Ask AI in the side panel to access the Agentic agent.
Explore the repository context and lineage
Navigate through the following tabs in the side panel to review the repository context and lineage. This helps prioritize remediation efforts based on application criticality and assess the potential production impact of vulnerabilities:
Displays the severity breakdown of issues, repository properties, and current scan information.
Internet Exposed: The code in the repository ultimately powers a publicly reachable cloud endpoint, calculated via the Code-to-Cloud graph.
Deployed to Runtime: The repository code is deployed to production runtime environments through CI/CD pipelines.
Public: The repository has public visibility in the VCS provider.
Deprecated: The repository or its components are marked as deprecated.
Cases: X Critical and High Cases when the repository has associated cases with Critical or High severity.
Issues: Shows X Critical and High Issues when the repository has associated issues with Critical or High severity.
For more information about scan management, refer to Application Security scans management.
Displays the business applications associated with the repository, including business criticality ratings and risk scores.
For more information about applications, refer to Defining Business Applications.
Displays the relationship graph from the repository asset to deployed cloud workloads.
Use the graph to perform these supply chain investigations:
Trace build paths: Identify CI/CD pipelines that build repository artifacts. Verify whether pipelines deploy to production.
Map cloud infrastructure: Identify cloud resources provisioned from repository IaC definitions.
Assess blast radius: Trace downstream deployment nodes to understand a vulnerability's production impact.
For more information, refer to Code to Cloud.
Investigate and remediate issues by category
The repository side panel organizes issues detected within the repository's underlying assets into dedicated tabs by issue category. Selecting an entry in the repository table opens the issue side card directly within the repository context, allowing you to investigate and remediate the risk without navigating away.
Scanner type: SCA
Known CVE vulnerabilities in open-source packages declared in dependency manifest files within the repository. Refer to Software Composition Analysis (SCA) vulnerability issues for more information.
Scanner type: SAST
Security weaknesses in first-party source code detected through static analysis. Refer to Manage code weakness issues for more information.
Scanner type: Secrets
Hardcoded credentials, API keys, tokens, and other sensitive values detected in source code and configuration files. Refer to Navigate to secrets issues for more information.
Scanner type: SCA
Open-source packages with operational risk indicators, such as deprecated or unpopular packages, or license types that violate organizational compliance policies. Refer to Package operational risk issues for more information.
Scanner type: IaC
Security misconfigurations in Infrastructure-as-Code templates. Refer to Navigate to IaC misconfiguration issues for more information.
Scanner type: CI/CD
Security risks and misconfigurations in CI/CD pipeline definitions associated with the repository. Refer to CI/CD Risks for more information.
Reference
For detailed information on investigating and remediating issues, refer to Code Security scanners.
Last updated
Was this helpful?