vulnerability-validation

You can validate security findings by analyzing scan outputs and threat-models to assess exploitability, determine data-flow reachability, and filter false positives. This process generates a validated-findings.json file containing only confirmed vulnerabilities.

Generating proof-of-concept exploits involves applying a validation workflow across your codebase to confirm exploitability. It analyzes data-flow paths from scan findings and produces structured PoC outputs alongside CVSS scores and mitigation guidance.

Calculating CVSS scores and mitigation notes is achieved by running a validation workflow on threat-model files. The workflow assesses exploitability and produces structured output files containing risk scores and remediation guidance.

Yes, vulnerability validation directly ingests security-findings.json outputs from commit-security-scan. It applies reachability and data-flow analysis to determine if detected vulnerabilities are actually exploitable within your specific codebase architecture.

Security scan reports often contain false positives because automated tools lack full codebase context. Reachability and data-flow analysis resolves this by tracing whether vulnerable code paths can actually be triggered by external inputs.

You need to run a vulnerability validation workflow after generating initial security findings or threat-models. It is required when you need to confirm exploitability, generate proof-of-concept exploits, and produce structured validated-findings.json output for patching decisions.