> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flintai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Scan results

> Read findings and prove you're ready to ship

**Scan complete.** Now turn findings into fixes — or confirm you're ready to ship.

## What's in your scan results

```json theme={null}
{
  "agents_found": 3,
  "framework_detected": "crewai",
  "findings": [
    {
      "id": "asi05_unexpected_code_execution_001",
      "category": "asi05_unexpected_code_execution",
      "ai_spm_severity": "Critical",
      "title": "Arbitrary Code Execution via eval()",
      "cvss_scores": { "base_score": 9.3 },
      "file_path": "src/agent.py",
      "line_number": 45,
      "evidence": "eval(user_input)",
      "remediation": "Use ast.literal_eval() for safe evaluation..."
    }
  ],
  "category_summary": {
    "asi05_unexpected_code_execution": 1
  }
}
```

## Understanding findings

Each finding shows:

**What's broken:**

* **`title`** - Clear description of the issue
* **`category`** - OWASP ASI01-ASI10 category (industry-standard mapping)
* **`evidence`** - The actual code that triggered the finding

**How severe:**

* **`ai_spm_severity`** - Critical, High, Medium, or Low
* **`cvss_scores.base_score`** - Industry-standard CVSS v4 score (0.0-10.0)

**Where to fix:**

* **`file_path`** - Exact file location
* **`line_number`** - Line where the issue appears
* **`remediation`** - How to fix it

## What to do next

**Clean scan (no findings)?**

* Attach `scan_<timestamp>.json` to your PR as proof
* Ship with confidence

**Issues found?**

<Steps>
  <Step title="Review findings">
    Check each finding's file path and line number.
  </Step>

  <Step title="Read remediation">
    Follow the fix guidance provided for each issue.
  </Step>

  <Step title="Fix the issues">
    Apply the recommended fixes to your agent code.
  </Step>

  <Step title="Re-scan to verify">
    ```bash theme={null}
    flintai scan /path/to/your/agent
    ```

    Confirm issues are resolved.
  </Step>

  <Step title="Ship with proof">
    Attach the clean scan to your PR.
  </Step>
</Steps>

## How severity is determined

Flint AI Scan uses **CVSS v4.0** (Common Vulnerability Scoring System) to calculate severity:

| **Severity** | **CVSS Score** | **Examples**                                    |
| ------------ | -------------- | ----------------------------------------------- |
| **Critical** | 9.0-10.0       | Hardcoded credentials, arbitrary code execution |
| **High**     | 7.0-8.9        | Prompt injection, missing auth                  |
| **Medium**   | 4.0-6.9        | Unbounded loops, missing validation             |
| **Low**      | 0.1-3.9        | Deprecated functions, warnings                  |

Severity comes from the CVSS vector, not subjective judgment. This gives you standardized risk scores you can show to security teams.

## Advanced: What Flint AI CLI filtered out

Your scan JSON may include:

**`triage_dismissed`** - Findings that describe expected behavior for your agent's purpose
**`triage_downgraded`** - Findings with disproportionate severity that were adjusted

This transparency shows what the Flint AI CLI AI reasoning layer filtered and why, so you can verify the triage decisions.

See [How scanning works](/flintai/cli/scan/how-scanning-works) for details on the 4-layer pipeline.

## Share your results

Attach `scan_<timestamp>.json` to:

* Pull requests (proof you validated before merging)
* Team reviews (show what you found and fixed)
* Security audits (OWASP/CVSS validation)

The JSON format is stable and shareable. Compare scans over time to track improvements.