Inspect findings

Every finding carries the detail needed to act on it, including an instruction written for a coding agent.

A severity and a rule name tell you something is wrong. Fixing it needs the file, the line, the mechanism and what “fixed” would look like. Findings carry all of that.

List a scan's findings

$ sentrasec finding list <SCAN-ID>

FINDING ID                              SEVERITY   RULE / CATEGORY         LOCATION89f6bb84-d79b-4caf-865d-87f0d7c146f5    critical   SAST-TAINT-CMDI         app.py:191e8f29fd-f137-490d-8a08-c02bf089f25b    high       SAST-PYTHON-SQLI-001    app.py:13

Narrow to what matters first:

$ sentrasec finding list <SCAN-ID> --severity high

Open one finding

$ sentrasec finding get <SCAN-ID> <FINDING-ID>

Prints the classification, the snippet, why it matters, the technical mechanism, the remediation steps, and the agent fix prompt.

Pipe a fix into an agent

Each finding carries a fix_prompt: an instruction naming the file, the line and the acceptance criteria for that specific finding. finding fix-prompt prints only that prompt to stdout, so it pipes cleanly.

$ sentrasec finding fix-prompt <SCAN-ID> <FINDING-ID> | claude -p

Fix the OS Command Injection vulnerability in app.py at line 19 where untrustedinput from request.args.get reaches subprocess.check_output via the host variable.The current code uses string concatenation and shell=True, allowing arbitrarycommand execution.Acceptance criteria:- subprocess.check_output or subprocess.run receives a list of arguments.- The shell=True parameter is completely removed.- Untrusted user input is never passed directly to a shell interpreter.

A finding with no fix_prompt exits non-zero rather than printing nothing, so a pipeline fails loudly instead of feeding an agent an empty instruction.

Verify a fix

Re-run the same scanner and compare. A finding that stops appearing is the evidence the fix landed — lifecycle_status becomes fixed, and occurrence_count shows how many runs it survived.

$ sentrasec scan --kind sast --path .

Secrets need rotation, not just an edit

A committed credential is compromised the moment it reaches history. Removing it from the file is necessary but not sufficient: rotate it at its source, move it to an environment variable or a secrets manager, and remember it remains in git history. A secrets finding is not closed by an edit alone.

What a finding carries

Field	Meaning
`severity`	critical, high, medium, low or info.
`rule_id`	The rule that fired, e.g. SAST-TAINT-CMDI.
`file, line_start`	Where it is, for a code finding.
`url`	Where it is, for a DAST finding.
`snippet`	The offending line, redacted where needed.
`cwe, owasp`	Classification, for reporting and triage.
`business_impact`	What it means if exploited, in plain terms.
`technical_details`	The mechanism — how the input reaches the sink.
`remediation_steps`	Numbered steps to fix it.
`fix_prompt`	An agent-ready instruction with acceptance criteria.
`lifecycle_status`	open, fixed or reappeared, compared across runs.
`occurrence_count`	How many runs this finding has been seen in.

Use --format json on any of these commands for the full record. See the scanning guide for how to produce a scan in the first place.