Chapter 09 of 12
Triaging Findings
Severity against confidence, reproducing before reporting, the difference between a false positive and an accepted risk, and what a security score is actually good for.
A scanner that raises fifty findings on its first run against an existing API is behaving normally. What happens next decides whether anyone ever reads run two.
Severity and confidence are two different questions
A single ranking hides the distinction that makes a list workable.
Severity answers what it would cost if the finding is real. Confidence answers how much the evidence supports it. They move independently, and every combination means something different in practice.
The practical rule falls out of the grid. Read severity to decide what to look at first and read confidence to decide how much to trust it before you act.
Reproduce before you report
A finding is a claim about behaviour, so the cheapest way to resolve an argument about it is to make the request again by hand.
Reproduction does three things at once. It confirms the behaviour still exists, since the scan may have run before a deploy. It tells you the real conditions, which are often narrower than the report implies. And it gives whoever fixes it a starting point instead of a description.
That is why the reproduction step belongs before the ticket rather than after it. Handing somebody a finding you have not reproduced is handing them your uncertainty along with the work.
Four honest outcomes
Every finding ends in one of four places, and each one needs a sentence.
Fixed means the behaviour changed. False positive means the tool was wrong, and the sentence should say why, because the same detector will do it again next month. Accepted risk means the tool was right and you are not changing anything, which is a legitimate engineering decision when the exposure is bounded and the fix is disproportionate. Duplicate means another item already covers it.
The sentence is the whole point. Six weeks later the question is never what the status was, it is why, and without a note the same debate runs again with less context than it had the first time.
A score is a direction, not a verdict
A single number is useful for two things. It shows a trend over weeks, and it gives someone who will not read a findings list something to react to.
It cannot do the other job people ask of it. Two projects with the same score are not in comparable shape. A critical finding on a payment endpoint and one on an internal reporting tool move the number the same way and are not the same problem. Use the score to notice that something changed and then go and read what changed.
The one property a score needs to be trustworthy is a published formula. A number you cannot reconstruct is a number you cannot argue with, and a number you cannot argue with gets ignored the first time it disagrees with you.
In Routebase
Every finding carries a severity and a confidence as separate fields, and the list sorts by severity with filters for status, severity and assignee.
The detail view has three tabs. Overview carries the scanner, the confidence, the assignee and the resolution note. Evidence carries a ready-to-run reproduction curl command, plus the raw scanner evidence as copyable JSON for pasting into an issue tracker. Guidance carries remediation for the OWASP category, with code examples in C#, TypeScript and Python where they exist, and reference links to OWASP and CWE.
The status workflow is enforced rather than advisory. Moving between open and in progress is free, and moving to any resolving status, meaning fixed, false positive, accepted risk or duplicate, opens a dialog that requires a short note before it will save. Resolved findings cannot be reopened by hand, and a later scan that detects the same issue reopens it automatically. Bulk triage applies one status to a selection, and the server skips any item whose current status cannot legally make that transition rather than forcing it.
The score is published rather than proprietary. It starts at one hundred and subtracts only for open findings. The penalties are twenty five per critical capped at sixty, ten per high capped at thirty, three per medium capped at fifteen and one per low capped at five. Two small bonuses add two points for a completed scan in the last seven days and three points for having at least one scheduled profile, and the result is clamped between zero and one hundred. Bands are good from eighty, fair from fifty and poor below that, and the same number feeds the project governance score as a weighted component that defaults to twenty percent. See Security Overview.
Frequently asked questions
How do you triage API security findings?
Sort by severity first and read confidence second, because severity says what it would cost and confidence says how likely the tool is to be right. Reproduce anything you are about to act on, since a finding you cannot reproduce is not yet a finding. Then give every closed item a status and a sentence explaining the decision.
What is the difference between a false positive and an accepted risk?
A false positive means the tool was wrong, so the behaviour it described does not exist. An accepted risk means the tool was right and you have decided not to change anything, usually because the exposure is bounded or the fix costs more than the risk. Recording them as the same thing loses the distinction that matters in three months.
Should a security finding be reopened automatically?
Yes, because a fix that was quietly reverted is exactly the case nobody re-checks by hand. If a later scan sees the same issue on the same endpoint, the item should come back rather than staying closed on the strength of an old decision. That also means closing something is a statement about today rather than forever.
What is a security score good for?
It is good for direction and for conversations with people who will not read a findings list. A score that has been falling for three weeks is a useful signal. What it cannot do is compare two projects or stand in for the list. One critical finding on a payment endpoint and one on an internal tool move the number identically and do not mean the same thing.
Last reviewed by The Routebase Team.