Issues & Remediation
Triage findings, assign them, and take one from diff to merged pull request.
You will finish this page able to work a backlog end to end: filter it down, collapse duplicates, triage in bulk, hand work to a teammate or a tracker, and let an AI agent open the fix pull request.
The Issues workspace is where every finding from every project lands.
Finding the right findings
Search
The header search box (Search issue, PR, branch…) matches finding titles, pull requests and branches. It is debounced, runs server-side, and resets you to page 1.
Facets
The left rail holds checkbox facets. Each option shows a live count.
| Facet | Options |
|---|---|
| Severity | Critical, High, Medium, Low |
| Status | Open, Resolved, Accepted risk, False positive |
| Activity | Ongoing fixing |
| Scanner | SAST, SCA, Secret, IaC, DAST |
| Source | The engines that produced findings in your result set. Deep Agentic is pinned first |
| Reachability | Reachable, Not reachable |
| ATT&CK | MITRE technique ids present in your data |
Status = Open is selected by default. Selecting both Reachable and Not reachable is the same as selecting neither.
Severity, Status, Scanner, Source and Reachability filter server-side across the whole result set. ATT&CK and Ongoing fixing filter the current page.
The table
Columns: selection checkbox · Sev · Finding · CVSS · Status.
The Finding cell shows the title, then a mono sub-line with the CVE or rule id, the project, the engine, a changed in PR chip when the finding sits on a line the current pull request touched, and a reachability marker (● reachable / ○ safe).
Two title prefixes appear during automated work: 🛠 while an agent is fixing that finding, 🔀 once a fix pull request is open for it.
Findings are sorted by priority score, highest first. Click the CVSS header to sort by CVSS instead. Findings on a changed pull-request line always float to the top.
50 findings per page.
Group related
Turn on the Group related pill above the table to collapse findings that share one fix into a single expandable row.
- Dependency findings collapse by package, shown as
lodashwith 6 vulnerabilities and a6 CVEschip. - Everything else collapses by rule, shown as
Hardcoded API keywith 12 occurrences and a12 findingschip.
Each group row shows the highest severity in the group, the project, and a per-severity breakdown. The group checkbox is tri-state: tick it and every finding in the group joins your selection, so a bulk action applies to the whole cluster. Expand a group to open any individual finding.
Grouping runs over the findings already loaded and filtered. It does not change your query.
Bulk actions
Select one or more findings and the bulk bar appears.
| Button | What it does |
|---|---|
| Re-verify with AI | Re-runs AI triage over the selection. 2 credits per batch, up to 25 findings |
| Assign | Opens the assign dialog, a teammate, or a person in a connected tracker |
| Change status | Marks the selection fixed |
| Suppress | Sets the selection to accepted risk |
| ✕ | Clears the selection |
Statuses you can set
From the detail drawer's Status dropdown:
| Label | Meaning |
|---|---|
| Open | Live and untriaged |
| Fixed | Remediated |
| Accepted Risk | Real, understood, deliberately not being fixed |
| False Positive | Not a real issue |
In the table these collapse to four pills: Open, In progress (an agent is fixing it), Resolved, Suppressed (accepted risk or false positive).
The detail drawer
Click any finding. A right-hand drawer opens with one continuous view:
- Header: severity chip, the mono CVE or rule id, a changed in PR chip where relevant, and the title
- At a glance: CVSS, weakness, scanner, project
- Priority: the 0-100 score and its band, with the note blended: CVSS × reachability × exploitability, plus
KEV · actively exploitedandEPSS {x}%chips where they apply - Reachability:
● REACHABLEor○ NOT REACHABLE · SUPPRESSED, with the evidence string - Status: the dropdown above
- Location:
file:line - ATT&CK Technique: links out to attack.mitre.org
- Evidence / PoC: collapsible
- Description
- Remediation: numbered steps, plus Create Jira ticket
- AI Analysis: AI confidence with the validating model, AI reasoning, attack scenario, and the taint chain as a file-by-file timeline
- AI Fix: appears once a fix pull request exists: the PR number, branch, a reminder that it is not auto-merged, and a link to open it
Drawer actions
| Button | What it does |
|---|---|
| Assign to Agent | Hands the finding to the AI Security Engineer. It clones the repo, fixes it, verifies, and opens a pull request |
| Assign | Assign to a teammate, or create and assign the issue in Jira or Linear |
| Re-verify | Re-runs AI triage on this one finding. 2 credits |
While an agent is fixing the finding, those three buttons are replaced by a live progress panel and you cannot re-assign it. Track it on the AI Activity page.
Assigning work
Click Assign (drawer or bulk bar) to open the assign dialog. It lists people in three groups:
- Team: Argus members in your organization. Assigning sets the finding's assignee.
- Jira: creates the issue in Jira and assigns it to that person.
- Linear: creates the issue in Linear and assigns it to that person.
Me assigns to yourself in one click. If neither tracker is connected, the dialog says so and points you to Settings → Integrations. If a tracker call fails, the dialog stays open and shows the real error. It never reports a false success.
The drawer's Create Jira ticket button (in Remediation) creates a Jira issue for the single finding.
Assign to Agent, the AI Security Engineer
Assign to Agent runs an autonomous coding agent against one finding. It clones the repository, applies the smallest correct fix, verifies it, and opens a pull request.
The button reads Assign to Agent · 15 credits.
While it runs you see an estimated phase and a progress bar. Phases:
- Cloning the repository
- Analyzing the finding
- Generating the fix
- Verifying (build + re-scan)
- Opening the pull request
You can close the modal, the job keeps running. Expect several minutes: it runs a real coding agent and a real build.
Outcomes
| Outcome | What it means |
|---|---|
| Pull request opened | A branch and PR exist. Review and merge on GitHub, Argus never auto-merges |
| The agent made no changes | The agent could not produce a safe edit |
| Fix generated, but flagged for review | A diff exists but verification did not pass cleanly. Review it manually |
| The agentic fix failed | The run errored. The error is shown |
The result panel shows the proposed change as a coloured diff with +added −removed counts, plus any advisories, for example that the sandbox build did not pass (often missing environment secrets), or that a re-scan flagged new high-severity findings in the changed files.
Approval gate. Admins can require that agent fixes are approved before they run. See Policies and gates.
Re-verify with AI
Re-verification re-runs triage against a finding and its stored evidence, then updates the verdict.
- Where: the bulk bar (Re-verify with AI) and the drawer (Re-verify).
- Cost: 2 credits per batch, not per finding. Charged only on success, if no AI provider is configured, nothing is charged.
- Batch cap: 25 findings per call.
Results are conservative:
| AI confidence | Action |
|---|---|
| ≥ 0.7 that it is a false positive | Auto-marked False positive |
| ≥ 0.6 that it is real | Marked verified; a suppressed finding is reopened |
| Below both | Left as uncertain, unchanged |
The summary toast reads, for example: Re-verified 18 finding(s): 11 confirmed, 5 marked false-positive, 2 uncertain.
Use this on a noisy secret or SAST backlog before you spend engineering time on it.
The Remediation workspace
Remediation is a focused, one-finding-at-a-time view: pick a finding · review the fix · open a pull request. Choose a project, then pick from the open findings ranked by priority.
| Action | What it does | Cost |
|---|---|---|
| Assign to Agent | The full agentic fix flow above | 15 credits |
| Preview AI fix | Generates a proposed patch without touching the repository | Uses AI credits |
| Verify re-scan gate | Re-checks whether the finding is still reported | Free |
Expand Proposed patch to read the diff, or Remediation brief (agent-ready) to copy a self-contained task description into your own tooling. When a run completes you see either a PR #N opened confirmation linking you to review and merge on GitHub, or the re-scan verdict: Re-scan GREEN when remediation is confirmed, Re-scan gate not met when it is not.
Exporting
The Export button on Issues downloads the current page as CSV with these columns:
Severity, Title, Type, Status, CVE, CVSS, Project, File, Line, Reachable, Author, Introduced
For a machine-readable feed of a whole project, use the API instead, ExportSarif for SARIF, or listVulnerabilities for JSON. See API reference. For a shareable HTML report, use the project report endpoint.
Next
- Pull request security, catch findings before they merge
- Policies and gates, decide what stops a build
- API reference, triage from scripts