Skip to main content
Scan complete. Now turn findings into fixes — or confirm you’re ready to ship.

What’s in your scan results

Understanding findings

Each finding shows: What’s broken:
  • title - Clear description of the issue
  • category - OWASP ASI01-ASI10 category (industry-standard mapping)
  • evidence - The actual code that triggered the finding
How severe:
  • ai_spm_severity - Critical, High, Medium, or Low
  • cvss_scores.base_score - Industry-standard CVSS v4 score (0.0-10.0)
Where to fix:
  • file_path - Exact file location
  • line_number - Line where the issue appears
  • remediation - How to fix it

When a scan is incomplete

switch-trust scan runs several static analysis tools alongside its AI reasoning. If one of them isn’t available, the scan still finishes and writes its results without it. The summary names the tool under Skipped and warns that the findings are partial. From version 1.8.0, the scan then exits with code 26, so a CI build fails. See Exit codes. In practice this is usually OpenGrep. It’s a standalone binary rather than a Python package, so pip install switch-trust-cli doesn’t bring it along. Your results file records the same detail under scan_metadata.tools_skipped, with a reason for each tool:
tools_used also lists the AI reasoning and triage layers with the model each one ran on, so you can tell from the results file alone whether those layers ran. A skipped tool means a whole family of checks never ran, so a short findings list isn’t proof of a clean codebase. Install what’s missing, then re-scan. In CI, check that scan_metadata.tools_skipped is empty before you treat a scan as passing.

What to do next

Clean scan (no findings)? Check that no tools were skipped, as described above, and you’re done. Issues found?
1

Review findings

Check each finding’s file path and line number.
2

Read remediation

Follow the fix guidance provided for each issue.
3

Fix the issues

Apply the recommended fixes to your agent code.
4

Re-scan to verify

Confirm issues are resolved.
Integrate with CI/CD. Run the scan in your pipeline so new issues are caught on every change. See CI/CD integration guide →

How severity is determined

Switch Trust Scan uses CVSS v4.0 (Common Vulnerability Scoring System) to calculate severity: Severity comes from the CVSS vector, not subjective judgment. This gives you standardized risk scores you can show to security teams.

Advanced: What Switch Trust CLI filtered out

Your scan JSON may include: triage_dismissed - Findings that describe expected behavior given what your agent is for triage_downgraded - Findings with disproportionate severity that were adjusted This transparency shows what the Switch Trust CLI AI reasoning layer filtered and why, so you can verify the triage decisions. See How scanning works for details on the scanning pipeline.

Next steps

Run scans in CI

Scan every pull request and keep the results as build artifacts. Validation stops depending on anyone remembering to run it, and you build a history to compare against.

Send findings to your security tools

Write SARIF with --format sarif and upload it to GitHub code scanning. Findings land in the Security tab and as annotations on the pull request.