Recommendations
Where a finding tells you how to fix it.
A finding gives advice on fixing it from three sources.
From the scanner
Most scanners describe the problem and how to fix it. The finding shows this as its Description and mitigations, often with links to the scanner’s own documentation.
From the CWE
When a finding has a CWE, Industry Recommendations on the finding lists the potential mitigations of that weakness from MITRE’s CWE catalog. Click Show recommendations to expand them.
Scanners set the CWE of their findings. To set or change it yourself, select findings in Findings and add a CWE with the bulk actions.
The catalog is in the settings, under Etc, then CWE List. Open a CWE to read its description, consequences, detection methods and mitigations, or click View findings to see the findings that have it. You can also add a CWE of your own, with its name and description, for example for a weakness that’s specific to your company.
From an LLM
With an LLM integration, Ask next to the finding’s name opens the chat with the finding attached. Ask how to fix it in your code base, or for an example of the fixed code.