> For the complete documentation index, see [llms.txt](https://docs.konvu.com/konvu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.konvu.com/konvu/triage-and-remediation/exploit-reproduction/reproducing-scanner-findings.md).

# Reproducing Scanner Findings

Reproduce eligible SAST and SCA findings in an isolated sandbox. Early access, enabled per organization.

Konvu can reproduce a SAST or SCA finding the same way it reproduces a vulnerability report: deploy your application in an isolated sandbox and try to demonstrate the finding. Use it when a static assessment result is not enough, for example before escalating a finding to a team that disputes it.

{% hint style="warning" %}
Scanner finding reproduction is in early access and is enabled per organization by Konvu. If you do not see a **Reproduce** control on an eligible finding, contact your Konvu team.
{% endhint %}

## Eligible findings

| Finding type         | Eligible when                                                                                                                                       |
| -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Code (SAST)**      | The finding comes from GitHub CodeQL, on a connected, active repository.                                                                            |
| **Dependency (SCA)** | Konvu has assessed the finding as **Exploitable**, and the finding is inside your [assessment scope](/konvu/administration/assessment-settings.md). |

In both cases, the repository must be on **github.com**, connected through the Konvu GitHub App with read access to repository contents. GitHub Enterprise Server and GitLab repositories are not supported yet. Container findings and secrets are never reproduced.

## Run a reproduction

1. Open the finding and select the **Reproduction** tab.
2. Select **Reproduce**.

Konvu deploys the **latest commit** of the finding's branch and tries to demonstrate the finding. The commit is fixed when the run starts, so later pushes do not change a run in progress.

The tab shows each stage as it runs:

| Status                                     | Meaning                                                         |
| ------------------------------------------ | --------------------------------------------------------------- |
| **Writing the claim to test**              | Konvu is turning the finding into a specific, testable claim.   |
| **No testable claim could be stated**      | The finding is too vague to test, so no sandbox is started.     |
| **Queued for a sandbox run**               | Waiting for a sandbox.                                          |
| **Running in a sandbox**                   | The application is deployed and the exploit is being attempted. |
| **Finished**                               | A reproduction result is available.                             |
| **Could not resolve the requested target** | Konvu could not find the branch or commit to deploy.            |

## Read the result

Scanner findings use the same reproduction results as reports: Exploitable, Not exploitable, Hardening, or Inconclusive. See [Reading a Reproduction](/konvu/triage-and-remediation/exploit-reproduction/reading-a-reproduction.md).

A successful reproduction marks the finding **Exploitable · Reproduced**, even if the static assessment disagreed. A Not exploitable result marks the finding **False Positive · Not reproducible**, and the evidence appears on the **Reproduction** tab. A Hardening or Inconclusive result never downgrades the finding.

## Limits

* Konvu reproduces scanner findings only on request.
* Only the latest commit is tested.
* Everything in [What reproduction does NOT do](/konvu/triage-and-remediation/exploit-reproduction/how-reproduction-works.md#what-reproduction-does-not-do) applies.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.konvu.com/konvu/triage-and-remediation/exploit-reproduction/reproducing-scanner-findings.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.