Accepted risk and false positives
Two ways to close something you are not going to fix, both recorded, both permanent until you reopen them.
Not every finding deserves a fix. A dismissal is a first-class decision here: it takes a reason, it is written to the audit log with who made it, and it stops that finding coming back at you.
- Accepted risk
- It is real, and you have decided to live with it. The finding is closed and stays closed until you reopen it.
- False positive
- It is not real. Same effect, different meaning, and it tells us where a rule needs work.
- Ignore
- A lighter dismissal for noise you do not want to argue with. Also recorded.
What a dismissal changes
- The finding leaves the fix-first list and the alerting path.
- No AI task will ever run on it again - dismissed work never spends a credit.
- The decision, its reason and its author are in the audit log.
- A later scan will not raise it again under the same fingerprint.
Select several findings in the issues table and dismiss them in one action with one reason, rather than clicking through them individually.
Questions
Can I undo a dismissal?
Yes. Reopen the finding and it returns to the fix-first list; both the dismissal and the reopening stay in the audit log.
Does a dismissal apply to other sites?
No. A dismissal is scoped to the finding it was made on, in that site. The same weakness elsewhere is a separate decision.
I keep getting the same false positive. Can you fix the rule?
Please tell us which rule id and why. False positive is the signal we use to decide what to tighten.
Something here wrong, missing or out of date? Tell us and we will fix the page.