> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vidocsecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Feedback on findings

> Tell Vidoc that a finding in a pull request is correct or wrong, so that later scans use your decision.

You can tell Vidoc that a finding is a real issue or a false positive. Vidoc records your decision and your reason as a learning. In later scans, the validation agent uses the learning when it checks similar findings.

| Method                           | GitHub | GitLab | Bitbucket Cloud | Bitbucket Data Center |
| -------------------------------- | ------ | ------ | --------------- | --------------------- |
| Reply in the thread of a finding | ✓      | ✓      | ✗               | ✗                     |
| 👍 and 👎 reactions              | ✓      | ✓      | ✗               | ✓ (7.21 and later)    |
| Web app                          | ✓      | ✓      | ✓               | ✓                     |

## Reply to a finding

Reply in the Vidoc thread of the finding. Write a clear statement and give the reason. Vidoc uses an AI model to classify your reply as one of these:

* **False positive**: the finding is not a real issue.
* **True positive**: the finding is a real issue.
* **Unclear**: Vidoc does nothing.

Vidoc acts only when the classification has high confidence. Examples of good replies:

```text theme={null}
False positive: this input is validated in the AuthorizationMiddleware before it gets to this handler.
```

```text theme={null}
False positive: this endpoint is only available on the internal admin network, and the value comes from our own config.
```

```text theme={null}
Confirmed. This is a real issue. We will add a parameterized query.
```

### What Vidoc does

| Classification | What Vidoc does                                                                                                              |
| -------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| False positive | Vidoc sets the issue to ignored and creates a learning. Vidoc replies, resolves the thread, and updates the summary comment. |
| True positive  | Vidoc creates a learning and replies in the thread.                                                                          |
| Unclear        | Vidoc does nothing.                                                                                                          |

For a false positive, Vidoc replies with this text: "Thanks — I recorded this as a **false positive** and created a learning so future scans take it into account. The issue has been ignored and this thread resolved."

A learning is a record of your decision and your reason. In later scans, the validation agent uses the learning when it checks similar findings in the same repository. For example, a false-positive learning can make the agent reject a similar finding. Then Vidoc does not comment on it.

<Warning>
  There is no approval step. A clear false-positive reply ignores the issue immediately. Any linked user with access to the project can do this, with any Vidoc role. We recommend that your AppSec team examines new learnings on the [Memory](/web-app/memory) page regularly. Filter by the sources **False positive**, **Confirmed true positive**, and **Pull request**. Select **Mark superseded** for each wrong entry.
</Warning>

A superseded learning does not reopen the issue that it ignored. To reopen the issue, find it on the [Findings](/web-app/findings) page and set it to Open.

<Info>
  The **Memory** and **Findings** pages need the Enterprise plan on Vidoc Cloud. They are included in self-hosted installations.
</Info>

### Rules for replies

* Your platform account must be linked to a Vidoc user with access to the project. Refer to [Link your account](#link-your-account).
* The first clear verdict in a thread applies. Vidoc ignores later replies with a different verdict.
* Vidoc does not read edited replies again. Write a new reply.
* A verdict changes only the one finding in the thread.

To ask a question about a finding instead, mention the Vidoc handle in the thread. Refer to [Commands and questions](/pull-requests/commands).

## Reactions

You can add 👍 or 👎 to a Vidoc inline comment on GitHub, GitLab, and Bitbucket Data Center 7.21 and later. Vidoc does not collect reactions on Bitbucket Cloud.

Vidoc collects reactions when the PR closes. On GitHub and GitLab, Vidoc also collects them when a person replies in the thread.

Reactions are feedback for Vidoc only. A reaction does not change the status of an issue and does not create a learning.

## Link your account

To record your reply, Vidoc must match your platform account to a Vidoc user with access to the project. The Vidoc role of this user is not important. On GitHub, the same link is necessary for questions and "remember" requests.

Vidoc uses one of these methods:

1. **SCM usernames.** In the Vidoc web app, open the account menu and select **SCM usernames**. Type your username in the row of your platform, then click **Save**.

   | Platform              | Value to type                      |
   | --------------------- | ---------------------------------- |
   | GitHub                | Your GitHub handle (without `@`)   |
   | GitLab                | Your GitLab username (without `@`) |
   | Bitbucket Cloud       | Your Bitbucket nickname            |
   | Bitbucket Data Center | Your Bitbucket username            |

   The dialog shows only the platforms that are connected in your organization.

2. **GitHub sign-in.** On GitHub, Vidoc uses the link that it records when you sign in with GitHub in the connection flow.

3. **Email.** On GitHub and GitLab, Vidoc matches the public email of your platform profile with the email of your Vidoc account. If your profile shows no email, this method does not work. Bitbucket Cloud does not give user emails to Vidoc.

If Vidoc cannot match your account, it replies with instructions to link your account. Vidoc does not record the verdict. For more about **SCM usernames**, refer to [Settings](/web-app/settings).

## Feedback on Bitbucket

Vidoc does not read PR comments on Bitbucket. Replies to findings have no effect. To give feedback:

1. Open the finding in the Vidoc web app. For example, open the PR on the [Pull requests](/web-app/pull-requests) page and select the finding, or use the **Export to AI agent** link in the inline comment.
2. In the issue panel, change the status of the finding, for example to Ignored or False positive, and give a reason.

When you give a reason, Vidoc creates a learning, as for a reply on GitHub or GitLab. For the statuses, refer to [Findings](/web-app/findings).

If you do not have a Vidoc account, ask your AppSec team to change the status.