> ## Documentation Index
> Fetch the complete documentation index at: https://qodex.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Findings

> Findings are issues Qodex records with severity, evidence, reproduction steps, and lifecycle status.

# Findings

Findings are the durable issues Qodex creates when a test or a code scan finds something worth tracking. A finding includes the bug description, severity, evidence, reproduction steps, category, status, and the scenario that produced it. Open them from **Findings** at the top of the sidebar.

Qodex does not turn every failed run into a finding. It first classifies the failure as a real bug, stale test, or environment issue. Only real product or security issues should become findings.

![Findings page with the All, Testing, and Code scan switch, search, and filters, and a finding's detail panel showing severity, first and last seen, the claim, steps to reproduce, evidence, and Mark as actions](https://mintcdn.com/qodexai/8H5N-Qajjdx9V4Gb/images/docs/findings/finding-detail.png?fit=max\&auto=format\&n=8H5N-Qajjdx9V4Gb\&q=85\&s=05443cfdc0bb352a3562c1fae87c9975)

## What a finding contains

| Field | What it tells you |
| - | - |
| Title and description | What Qodex believes is wrong. |
| Severity | Impact if the issue ships or remains unfixed. |
| Category | Security, functional, UI, performance, accessibility, data integrity, API error, or other. |
| Claim | For access findings, one line such as "a viewer can delete the project". |
| Basis | What the finding was judged against: a rule you wrote, your answer to a question, what a run observed, a line of code, or an assumption. |
| Evidence | Request, response, screenshot, log, URL, or note. |
| Reproduction steps | Steps a human can follow to confirm the issue. |
| First seen and last seen | When the issue was first recorded and last observed, with a count when it was seen more than once. |
| Status | Open, needs review, fixed, false positive, or won't fix. |

## How findings are created

Findings can come from several places:

* API scenarios that fail with a real product issue.
* UI scenarios with evidence-backed failures.
* Security scenarios where the attack succeeds.
* Agent investigations in chat or Autopilot.
* **Code scan**, which reads a linked repository and files what it finds.

The **All / Testing / Code scan** switch at the top of the Findings page separates findings from testing and chat from findings a code scan filed. Results of a Security scan stay on the **Security scans** page and are not listed here. PR review comments stay on the pull request.

A candidate Qodex is not sure about, such as an access claim with no rule behind it, is held as **Needs review** until someone on your team decides.

## Does Qodex fix issues automatically?

Qodex's automatic fixing is about keeping tests current, not patching your application.

When a UI test fails because the page changed rather than because of a bug, Qodex re-resolves the step and repairs the test on its own, so stable coverage keeps replaying. See [replay cache and self-healing](https://qodex.ai/docs/ui-testing-replay-cache.md).

For a real product bug, Qodex does not rewrite your code for you. It finds the bug, classifies it as a real issue, and files a finding with severity, evidence, and reproduction steps. In [PR review](https://qodex.ai/docs/pr-review.md) it can suggest a code change inline that you choose whether to apply.

## Explore this section

> [card] [Severity model](https://qodex.ai/docs/findings-severity-model.md)
>
> Understand critical, high, medium, low, and info.

> [card] [Failure classification](https://qodex.ai/docs/findings-failure-classification.md)
>
> See how Qodex decides whether a failed run is a real bug.

> [card] [Triage workflow](https://qodex.ai/docs/findings-triage-workflow.md)
>
> Filter, review, and move findings through their statuses.

> [card] [Findings concept](https://qodex.ai/docs/concepts-findings.md)
>
> Read the shorter conceptual overview.

## Related

> [card] [Security testing](https://qodex.ai/docs/security-testing.md)
>
> Learn how attack scenarios produce security findings.

> [card] [Run tests](https://qodex.ai/docs/run-tests.md)
>
> Run scenarios that can create or verify findings.

## On the roadmap

> [!TIP]
>
> Planned improvements include rolling flakiness scoring, Jira and Linear ticket creation, and SARIF export.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.