Issues and triage
Every finding becomes an issue with a stable key (such as VK-123), kept
across scans. When a scan no longer finds an issue it closes on its own; if
it comes back, it is reopened.
Views
Open Issues to see the list for every org and repository you can see, or one at a time. Switch between a list and a board, filter by severity, risk, rule, repository, branch or file, and save a filter as a Saved View.
| View | Shows |
|---|---|
| Top Issues | What to fix first |
| Combined Risks | Entry points where several weaknesses meet |
| To Triage | New issues nobody has looked at |
| Open | Everything still open |
| Ready to Close | Issues whose Jira ticket is done, for a person to confirm |
| Pending | Proposals waiting for an approver |
| Suppressed, Resolved | Closed out, with who decided and why |
| Mine | Assigned to you |
Triage states
| State | Applies |
|---|---|
| New, In Progress, Fixed | At once |
| False Positive | After an approver agrees; needs a reason |
| Accepted Risk | After an approver agrees; needs a reason and an expiry |
A proposal stays counted until it is approved. In Workspace Settings > Issues > Approvals you can require a second approver, let approvers approve their own rule changes, or apply AI verdicts without approval (off by default, since a wrong verdict would hide a real finding). Longest Accepted Risk caps how long an accepted risk may last.
Owners and assignment
- Owners come from
CODEOWNERSfor code, and from the last person who changed a component in Salesforce. - Assign an issue to a member, or let Auto-Assign rules do it by repository, path, risk or severity (earlier rules win).
- Teams (Workspace Settings > Teams) group orgs and repositories and narrow the issue list to them.
Fix deadlines
Every open issue gets a deadline from its severity, scaled by the criticality of its org or repository:
| Severity | Days (default) |
|---|---|
| Critical | 15 |
| High | 30 |
| Medium | 90 |
| Low | 180 |
High and Medium criticality keep the deadline (x1); Low criticality doubles it. Change both in Workspace Settings > Issues. Members get an "Issue Due Soon" reminder before the deadline.
From the terminal
vulkro cloud todo and vulkro-sf cloud todo list the same queue, and
triage and assign work from there too. See
Connect the CLI.