---
title: "Find vulnerabilities"
description: "How findings get into AppSec Portal: audits run by Auditor, reports sent over the API, uploaded files and findings added by hand."
url: https://whitespots.io/docs/appsec-portal/find-vulnerabilities
slug: appsec-portal/find-vulnerabilities
publish_date: 2026-10-30T19:42:15.000Z
last_modified: 2026-10-30T19:42:15.000Z
---

# Find vulnerabilities

Findings get into Portal in four ways. Use the first one wherever you can.

| Way | When to use it |
| --- | --- |
| [Audits](https://whitespots.io/docs/appsec-portal/find-vulnerabilities/audits) run by Auditor | The main way. Auditor runs the scanners on your assets on demand, on a schedule, on every push and on every new image, and sends the results back. |
| [The API](https://whitespots.io/docs/appsec-portal/find-vulnerabilities/import-scan-results#send-reports-over-the-api) | Your scanners already run somewhere else, for example in CI pipelines, and you can't move them yet. |
| [Upload a report](https://whitespots.io/docs/appsec-portal/find-vulnerabilities/import-scan-results#upload-a-report) | You got a report file from somewhere: a one-off scan, a vendor, a penetration test tool. |
| [Add a finding by hand](https://whitespots.io/docs/appsec-portal/find-vulnerabilities/import-scan-results#add-a-finding-by-hand) | A vulnerability that no scanner reports, for example from a manual review. |

Prefer audits over sending reports from CI pipelines. With audits, the scanners, their versions and
their settings live in one place, every asset is scanned the same way, and a new repository is
scanned without changing its pipeline. Reports from pipelines depend on each team keeping its
pipeline up to date, which is hard to cover with many repositories, and a full set of scanners
often makes a pipeline run too long. That's why Portal moved from scanning in
CI pipelines to Auditor audits.

Every way needs to know which scanner wrote the report. Portal reads the
reports of the [supported scanners](https://whitespots.io/docs/appsec-portal/find-vulnerabilities/scanners). For any other scanner, set up how its reports are
read first: see [Bring your own scanner](https://whitespots.io/docs/appsec-portal/find-vulnerabilities/bring-your-own-scanner). Then run it as an
Auditor job rather than uploading its reports.

Findings from audits, the API and uploads arrive **Unverified** and go through the
[triage rules](https://whitespots.io/docs/appsec-portal/triage-findings/automate-triage) in the same way. Then see
[Triage findings](https://whitespots.io/docs/appsec-portal/triage-findings).

---

## Navigation

- Location: [Docs](https://whitespots.io/docs) > [Application Security Portal](https://whitespots.io/docs/appsec-portal)
- Previous: [Risk assessment](https://whitespots.io/docs/appsec-portal/products-and-assets/risk-assessment)
- Next: [Audits](https://whitespots.io/docs/appsec-portal/find-vulnerabilities/audits)

### Pages in this section

- [Audits](https://whitespots.io/docs/appsec-portal/find-vulnerabilities/audits)
- [Scanners](https://whitespots.io/docs/appsec-portal/find-vulnerabilities/scanners)
- [Bring your own scanner](https://whitespots.io/docs/appsec-portal/find-vulnerabilities/bring-your-own-scanner)
- [Import scan results](https://whitespots.io/docs/appsec-portal/find-vulnerabilities/import-scan-results)