Skip to main content

Triage workflow

Triage is the process of deciding what a finding means and what your team should do with it. Every finding starts as open. From there, you can mark it fixed, false positive, or wontfix.

1. Open the Findings page

The Findings page shows project findings with severity, category, status, and search filters. Header counts stay project-wide so you can see the overall open risk even while filtering.

2. Filter the list

Use filters to focus the queue:
  • Severity: critical, high, medium, low, info.
  • Status: open, fixed, false positive, wontfix.
  • Category: security, functional, UI, performance, accessibility, API error, other.
  • Search: title, description, or category.
  • Run: findings from one test run.

3. Review the evidence

Open a finding to inspect:
  • Description and category.
  • Reproduction steps.
  • Request and response evidence.
  • Screenshots or UI artifacts.
  • Logs, URLs, and notes.
  • Linked scenario or run.
Security findings usually include an OWASP category and the request that proved the issue.

4. Set the status

StatusUse it when
OpenThe finding still needs review or action.
FixedThe issue was fixed and no longer reproduces.
False positiveThe finding was not a real issue.
WontfixThe issue is real, but the team accepts it.
The status updates the same finding row whether you change it from the UI, chat, or API.

5. Re-run when needed

After a fix, re-run the related scenario or suite. If the finding no longer reproduces, mark it fixed. If it still fails, keep it open and use the latest evidence.

Severity model

Understand how impact is ranked.

Failure classification

See how Qodex decides whether to open a finding.

Run tests

Generate or verify findings.

Findings concept

Read the shorter overview.