Skip to main content
You can tell Vidoc that a finding is a real issue or a false positive. Vidoc records your decision and your reason as a learning. In later scans, the validation agent uses the learning when it checks similar findings.

​
Reply to a finding

Reply in the Vidoc thread of the finding. Write a clear statement and give the reason. Vidoc uses an AI model to classify your reply as one of these:
  • False positive: the finding is not a real issue.
  • True positive: the finding is a real issue.
  • Unclear: Vidoc does nothing.
Vidoc acts only when the classification has high confidence. Examples of good replies:

​
What Vidoc does

For a false positive, Vidoc replies with this text: “Thanks — I recorded this as a false positive and created a learning so future scans take it into account. The issue has been ignored and this thread resolved.” A learning is a record of your decision and your reason. In later scans, the validation agent uses the learning when it checks similar findings in the same repository. For example, a false-positive learning can make the agent reject a similar finding. Then Vidoc does not comment on it.
There is no approval step. A clear false-positive reply ignores the issue immediately. Any linked user with access to the project can do this, with any Vidoc role. We recommend that your AppSec team examines new learnings on the Memory page regularly. Filter by the sources False positive, Confirmed true positive, and Pull request. Select Mark superseded for each wrong entry.
A superseded learning does not reopen the issue that it ignored. To reopen the issue, find it on the Findings page and set it to Open.
The Memory and Findings pages need the Enterprise plan on Vidoc Cloud. They are included in self-hosted installations.

​
Rules for replies

  • Your platform account must be linked to a Vidoc user with access to the project. Refer to Link your account.
  • The first clear verdict in a thread applies. Vidoc ignores later replies with a different verdict.
  • Vidoc does not read edited replies again. Write a new reply.
  • A verdict changes only the one finding in the thread.
To ask a question about a finding instead, mention the Vidoc handle in the thread. Refer to Commands and questions.

​
Reactions

You can add 👍 or 👎 to a Vidoc inline comment on GitHub, GitLab, and Bitbucket Data Center 7.21 and later. Vidoc does not collect reactions on Bitbucket Cloud. Vidoc collects reactions when the PR closes. On GitHub and GitLab, Vidoc also collects them when a person replies in the thread. Reactions are feedback for Vidoc only. A reaction does not change the status of an issue and does not create a learning. To record your reply, Vidoc must match your platform account to a Vidoc user with access to the project. The Vidoc role of this user is not important. On GitHub, the same link is necessary for questions and “remember” requests. Vidoc uses one of these methods:
  1. SCM usernames. In the Vidoc web app, open the account menu and select SCM usernames. Type your username in the row of your platform, then click Save. The dialog shows only the platforms that are connected in your organization.
  2. GitHub sign-in. On GitHub, Vidoc uses the link that it records when you sign in with GitHub in the connection flow.
  3. Email. On GitHub and GitLab, Vidoc matches the public email of your platform profile with the email of your Vidoc account. If your profile shows no email, this method does not work. Bitbucket Cloud does not give user emails to Vidoc.
If Vidoc cannot match your account, it replies with instructions to link your account. Vidoc does not record the verdict. For more about SCM usernames, refer to Settings.

​
Feedback on Bitbucket

Vidoc does not read PR comments on Bitbucket. Replies to findings have no effect. To give feedback:
  1. Open the finding in the Vidoc web app. For example, open the PR on the Pull requests page and select the finding, or use the Export to AI agent link in the inline comment.
  2. In the issue panel, change the status of the finding, for example to Ignored or False positive, and give a reason.
When you give a reason, Vidoc creates a learning, as for a reply on GitHub or GitLab. For the statuses, refer to Findings. If you do not have a Vidoc account, ask your AppSec team to change the status.