Every issue Superagent raises lands in one place. Findings is the org-wide queue where red-team results and incoming GitHub advisories arrive deduplicated, get verified by automated triage, and turn into fix PRs. Security teams work the queue instead of chasing reports across tools.

Where findings come from

Kind	Origin	Typical content
repository_red_team	A repository report	Issues discovered during codebase analysis
web_app_red_team	A Web app report	Exploit paths found against a live application
github_advisory	GitHub advisory webhook	Incoming GHSA/CVE-style advisories for connected repos

All three appear in the same table with title, risk level, source, triage status, and linked report. Filter and sort to prioritize high-risk or unassigned work.

The finding detail page

Open a finding at /app/findings/[findingId] to:

• Read the description, CWE IDs, CVSS vector, and advisory links
• Review the triage summary, recommendation, and evidence when automated triage has run
• Inspect the proposed patch with its diff and code references when Superagent produced one
• Create a fix PR from the proposed patch without leaving the finding
• Update the triage status and record a resolution
• Navigate to the parent report for full scan context

Status lifecycle

Every finding moves through a four-stage lifecycle:

Status	Meaning
New	The finding arrived from a report or advisory and has not been triaged.
Triaging	An automated triage run is in progress (system-managed).
In review	Triage produced a verdict, or someone moved the finding into active review.
Resolved	The finding is closed with a recorded resolution.

When a finding is resolved, a resolution captures why it was closed:

Resolution	Use when
Fixed	The vulnerability was remediated.
Accepted risk	The issue is real but the risk is accepted.
False positive	The finding is not a real vulnerability.
Won't fix	The issue will not be addressed (also used by bulk archive).

Resolved findings can be reopened, which returns them to New and clears the resolution.

Triage workflow

1. A finding appears as New after a report completes or GitHub publishes an advisory.
2. Optionally run automated triage. The finding shows Triaging while the sandbox run is active.
3. When triage completes, a confirmed or inconclusive verdict lands in In review for a human decision; a not-reproducible verdict auto-resolves the finding as a False positive. If a run fails, the finding returns to its lane with a "Triage failed" indicator.
4. Resolve the finding with the appropriate resolution, or drag it to the Resolved column on the board (you will be prompted for a reason).
5. Track remediation in your issue tracker; use the finding page as the system of record in Superagent.

Automate the handoff

The finding.created and finding.triage_completed webhooks carry the triage summary, recommendation, evidence, and proposed patch diff to your own agents. The Findings API and the MCP server expose the same queue for custom workflows.

Next steps

• Red Team
• Webhooks
• Findings API