Findings

How Gecko scores, proves, and de-duplicates vulnerabilities.

A finding (used interchangeably with vulnerability) is a confirmed, exploitable security issue in a specific file, backed by a proven path from user input to a dangerous operation.

Vulnerability types

Gecko detects seven high-impact, server-side classes:

Type	Name
RCE	Remote Code Execution
SQLI	SQL Injection
XSS	Cross-Site Scripting
SSRF	Server-Side Request Forgery
LFI	Local File Inclusion
AFO	Arbitrary File Operations
IDOR	Insecure Direct Object Reference

The function call chain

Every finding includes an ordered call chain from a source (where attacker-controlled input enters) through intermediate functions to a sink (the dangerous operation), with file paths and line numbers at each step. One step is marked the primary vulnerable step, the single decision that makes the path exploitable.

This chain is the proof. It’s what lets you validate a finding quickly instead of re-deriving the data flow yourself.

Example chain

RCE · CVSS 9.8 (Critical) · confidence 10/10

 ① source   api/routes.py:31        cmd = request.json["cmd"]
 ② flow     services/runner.py:60   run_task(cmd)
 ③ sink     utils/shell.py:12       subprocess.run(cmd, shell=True)   ← primary vulnerable step

Scoring

Confidence (1 to 10)

How sure the agent is that the path is real and reachable. Only findings at 9 or above are persisted.

False-positive score (1 to 10)

The agent’s own skepticism check. High scores are filtered out before a finding is saved.

Severity (CVSS 4.0)

A 0 to 10 score computed from the CVSS 4.0 vector, labeled Critical (≥9), High (≥7), Medium (≥4), or Low.

CWE

The Common Weakness Enumeration identifier for the underlying weakness.

You can override severity on an individual finding when your environment’s context differs from the default CVSS assessment.

Status lifecycle

Each finding moves through a status you control during triage:

Status	Meaning
Open	Detected and not yet addressed.
In progress	A fix is underway (for example, a fix PR is open).
Fixed	The fix has been merged.
Fix verified	A post-merge rescan confirmed the vulnerability is gone.
False positive	Dismissed. Re-detection does not auto-reopen it.
Accepted risk	Risk explicitly accepted, optionally with an expiry date.

De-duplication

Each finding has a fingerprint derived from its type and sink. When a later scan detects the same issue, Gecko updates the existing finding (refreshing “last seen”) instead of creating a duplicate. A longer, better-proven chain supersedes the old one while keeping the same finding.

What you can do with a finding

From the finding drawer you can change status, adjust severity, request a fix PR, create a ticket in Jira, Linear, ClickUp, or Shortcut, export to JSON or Markdown, and copy a permalink.