Skip to main content
Scan complete. Now turn findings into fixes — or confirm you’re ready to ship.

​
What’s in your scan results

​
Understanding findings

Each finding shows: What’s broken:
  • title - Clear description of the issue
  • category - OWASP ASI01-ASI10 category (industry-standard mapping)
  • evidence - The actual code that triggered the finding
How severe:
  • ai_spm_severity - Critical, High, Medium, or Low
  • cvss_scores.base_score - Industry-standard CVSS v4 score (0.0-10.0)
Where to fix:
  • file_path - Exact file location
  • line_number - Line where the issue appears
  • remediation - How to fix it

​
When a scan is incomplete

flintai scan runs several static analysis tools alongside its AI reasoning. If one of them isn’t available, the scan finishes without it rather than failing. The summary names the tool under Skipped and warns that the findings are partial. In practice this is usually OpenGrep. It’s a standalone binary rather than a Python package, so pip install flintai-cli doesn’t bring it along. Your results file records the same detail under scan_metadata.tools_skipped, with a reason for each tool:
tools_used also lists the AI reasoning and triage layers with the model each one ran on, so you can tell from the results file alone whether those layers ran. A skipped tool means a whole family of checks never ran, so a short findings list isn’t proof of a clean codebase. Install what’s missing, then re-scan. In CI, check that scan_metadata.tools_skipped is empty before you treat a scan as passing.

​
What to do next

Clean scan (no findings)?
  • Attach your results file (scan_<timestamp>.json by default) to your PR as proof
  • Ship with confidence
Issues found?
1

Review findings

Check each finding’s file path and line number.
2

Read remediation

Follow the fix guidance provided for each issue.
3

Fix the issues

Apply the recommended fixes to your agent code.
4

Re-scan to verify

Confirm issues are resolved.
5

Ship with proof

Attach the clean scan to your PR.

​
How severity is determined

Flint AI Scan uses CVSS v4.0 (Common Vulnerability Scoring System) to calculate severity: Severity comes from the CVSS vector, not subjective judgment. This gives you standardized risk scores you can show to security teams.

​
Advanced: What Flint AI CLI filtered out

Your scan JSON may include: triage_dismissed - Findings that describe expected behavior for your agent’s purpose triage_downgraded - Findings with disproportionate severity that were adjusted This transparency shows what the Flint AI CLI AI reasoning layer filtered and why, so you can verify the triage decisions. See How scanning works for details on the 4-layer pipeline.

​
Next steps

Run scans in CI

Scan every pull request and keep the results as build artifacts. Validation stops depending on anyone remembering to run it, and you build a history to compare against.

Send findings to your security tools

Write SARIF with --format sarif and upload it to GitHub code scanning. Findings land in the Security tab and as annotations on the pull request.