Skip to main content

Glossary

Finding​

One detection: a rule matched some text at a specific place in Jira. A finding has a severity, a review status, a keyed fingerprint, and a source locator, and no copy of the matched text. It carries its review history forward across scans.

Occurrence​

One sighting of a finding in one scan run. A finding that keeps existing across five scans has one finding record and five occurrences, which is what makes "first seen" and "still present" meaningful.

Fingerprint​

A keyed HMAC of the matched value, used to recognise the same finding across scans without storing the value. It is what makes review decisions and suppressions stick. Derived from FINDING_FINGERPRINT_HMAC_SECRET, so changing that secret changes every finding's identity. See Security.

Review status​

A per-finding decision: OPEN, FALSE_POSITIVE, ACCEPTED_RISK, or FIXED. A one-time judgement about this finding.

Suppression​

A forward-looking rule that hides a class of known-safe matches from the active findings list - globally, or scoped to a rule, project, or field. Stronger and broader than marking one finding a false positive. Removed suppressions stay visible so hidden findings remain explainable. See Suppressions.

Rule​

A detection pattern: a regex plus severity, category, scope, and context keywords. A rule version can also carry validators - entropy, length, checksum, and keyword proximity. Either built-in or custom.

Rule version​

Rules are immutable and versioned. Editing a rule, or just toggling it on or off, appends a new version rather than changing the old one; findings record the exact version that produced them, and any earlier version can be rolled back to.

Scan configuration​

A saved definition of what to scan and how hard: projects, fields, comments, attachments, text mode, engine tuning, and an optional schedule.

Configuration version and config group​

Scan configurations are immutable snapshots. Saving changes creates a new version; all versions of the same configuration share a config group, which is what a schedule and a scan history attach to. A scan run records the exact version it used, so an old run is always explainable.

Text mode​

Whether a scan reads rendered text (as Jira displays it), raw field values (as stored, including markup), or both. Both is the default, and finds secrets hidden inside markup that rendering would swallow.

The mode a run used is recorded on every finding it produced: the text variant in a finding's source locator names which of the two representations the match was found in. A field Jira does not render contributes no rendered variant, so a RENDERED scan skips it rather than falling back to the raw value.

Scan run​

One execution of a scan configuration. Has a status (QUEUED, RUNNING, PAUSED, COMPLETED, FAILED, CANCELLED), counts, and a progress phase.

Detection state​

Whether a finding is still present in Jira, tracked separately from your review decision: ACTIVE, NOT_FOUND_IN_LATEST_FULL_SCAN (it was there before, the latest full scan no longer sees it), or SOURCE_UNAVAILABLE. A finding that quietly disappears is not the same as one someone fixed and marked fixed.

Restricted finding​

A finding the signed-in user is not authorized to see. The row exists, so counts stay honest, but its details are hidden and it cannot be selected for bulk action.

Pattern discovery​

An optional local analysis that finds repeated structured values no existing rule covers, and proposes them as candidate rules. Disabled by default and hidden from the navigation. See Pattern Discovery.

Licensed feature​

A capability gated by the signed license file: SCAN for scanning at all, SCAN_ATTACHMENTS for reading attachment contents. See License.