Scanner executions

Last updated: Nov 11, 2026

---

The DevSecOps section of your group shows the runs of the Fluid Attacks scanners. For each run, you can see the result, the vulnerabilities that the run found, the policy that the run applied, and the execution log.

Which runs the platform records

The platform records the runs of these scanners:

• sast
• sca
• ss

The platform records a run only when all these conditions are true:

• The run authenticates with a group.
• The run uses the nickname of a root of that group.
• That root is active.

If one condition is not true, the scanner shows this warning: "This execution was not recorded in the platform." The scan continues, and the warning does not change the exit code of the scanner.

Find the scanner executions

The scanner runs are in the same table as the CI Gate executions and the reviews of the Peer Reviewer Assistant. To see only the scanner runs, do these steps:

1. Go to the DevSecOps section of your group.
2. Click the filters button.
3. In Security check, select Scanner.

For a scanner run, the table columns show this data:

• Identifier: Run and the first 7 characters of the run identifier. Below it, the branch and the commit that the scanner examined.
• Security check: Scanner.
• Result: One of these values:
  • Passed: The run found no vulnerabilities at or above the CVSS threshold.
  • Failed: The run found one or more vulnerabilities at or above the CVSS threshold.
  • Incomplete: The run did not finish.
• Vulnerabilities: The total number of vulnerabilities that the run found, with the number of unmanaged and allowed vulnerabilities. The cell shows "—" when the run sent no totals.
• Git repository: The nickname of the root that the scanner examined.
• Executed day: The date and time of the run.

These filters apply to the scanner runs:

• Result
• Technique: The scanner runs use only the techniques of the Static group. The scanners use SAST, SCA, and SS.
• Strictness: Strict or Tolerant. A run is Strict when it has a CVSS threshold that can break the build.
• Git repository
• Executed day

The Breaks build filter is only for CI Gate. The Branch, Pull request, and Author filters are only for the Peer Reviewer Assistant.

You can also type the repository, the branch, or the identifier in the search bar.

The summary at the top of the section shows only CI Gate and the Peer Reviewer Assistant. It does not count the scanner runs.

View the details of a scanner execution

Click a scanner run in the table. A page opens with the title Scanner | Run and the run identifier. This page has two tabs: Vulnerabilities and Execution log. To go back to the table, click the back arrow.

Vulnerabilities

At the top, the Vulnerabilities tab shows four cards:

• Execution: The result of the run, Strictness, Executed date, and Identifier. Use the copy button to copy the full identifier.
• Scope: Git repository, Branch, Technique, and Commit. Use the copy button to copy the full commit.
• Security policy:
  • CVSS threshold: Vulnerabilities with a score at or above this value fail the run. If the run had no threshold, the card shows No threshold.
  • Threshold source: Where the threshold came from: Group policy, Local configuration, or Strict mode. When the local threshold is lower than the threshold of your group, the card also shows Stricter than the group policy and the threshold of your group.
• Vulnerabilities: The number of vulnerabilities that the run found. Gate divides them into two groups:
  • Unmanaged: Vulnerabilities at or above the threshold. They fail the run.
  • Allowed: Vulnerabilities below the threshold. They do not fail the run.

Below the cards, a table shows each vulnerability that the run found. These are its columns:

• Weakness: The weakness of the vulnerability, with a link to its description.
• Vulnerability: The path of the file.
• Specific: The line.
• Description
• Gate: Unmanaged or Allowed.
• Severity (v4.0): The CVSS v4.0 score.
• Technique

To find a vulnerability, type a file path or a weakness in the search box.

Some runs did not keep the list of their vulnerabilities. For these runs, the tab shows No vulnerability list, and only the totals are available.

Execution log

The Execution log tab shows the output of the scanner in the console during the run. Use it to find the cause of an Incomplete run.

What is not available for scanner runs

• The Generate report button of the DevSecOps section does not include the scanner runs. The report has only the CI Gate executions and the reviews of the Peer Reviewer Assistant.
• The scanner runs do not show the grace period or the days to technical debt. To break the build, a scanner uses only one CVSS threshold. For more information, read Break the build.