Finding Types & Classes

Overview

Finding types group related finding classes to simplify filtering and scoping. Each finding type maps to one or more finding class patterns.

Finding Type	Finding Classes	Description
Cryptographic Material	`crypto/*`	Cryptographic assets: algorithms, certificates, keys
Secret	`secret/*`	Embedded credentials: API keys, tokens, passwords
Mitigation Failure	`mitigation/*`	Missing security mitigations: stack canaries, CFI, ASLR
Weakness	`weakness/*`	Code quality issues: unstripped binaries, RPATH issues
Unknown Vulnerability	`vulnerability/uefi/*`	Zero-day vulnerabilities discovered through deep analysis
Known Vulnerability	`vulnerability/known-vulnerability`	Publicly documented vulnerabilities with CVEs
Supply-Chain Failure	`supply-chain/*`	Supply chain integrity issues
Dependency Vulnerability	`vulnerability/known-vulnerability` (derived from dependency analysis)	Vulnerabilities in external dependencies
Suspicious Code	`suspicious/*`	Potential tampering or obfuscation patterns
Malicious Code	`malware/*`	Confirmed malicious behavior

⌘I