> For the complete documentation index, see [llms.txt](https://docs.konvu.com/konvu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.konvu.com/konvu/triage-and-remediation/finding-types/code.md).

# Code (SAST)

How Konvu assesses, reproduces, and fixes vulnerabilities your SAST scanners flag in your own code.

A code finding says a static analysis rule matched a pattern in your code, such as user input reaching a SQL query. Whether it is exploitable depends on where that input comes from and what happens to it on the way. Konvu assesses each finding in your repository and tells you which ones hold up.

|                        |                                                                                                                                                             |
| ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Sources**            | GitHub CodeQL, Semgrep Code, Arnica, GitLab SAST, Black Duck Polaris                                                                                        |
| **Where to find them** | **Triage > SAST**                                                                                                                                           |
| **Assessed**           | Yes                                                                                                                                                         |
| **Reproduced**         | Early access, CodeQL findings only. See [Reproducing Scanner Findings](/konvu/triage-and-remediation/exploit-reproduction/reproducing-scanner-findings.md). |
| **Fix pull requests**  | Yes: targeted fixes in your code                                                                                                                            |
| **Credits**            | SAST pool. See [Assessment Credits](/konvu/administration/assessment-credits.md).                                                                           |

## What Konvu checks

Konvu runs an **investigation** for each finding. An agent follows the flagged code path in your repository:

* **Where does the input come from?** An HTTP request, a queue message, a config file, or a constant.
* **Does an attacker control it, and from which position?** Unauthenticated, logged in, or as an administrator.
* **What happens on the way?** Validation, sanitization, or an authorization check between the entry point and the flagged code.
* **What would the attacker gain?** The impact if the flagged code runs on attacker input.

Assessments run highest severity first, within your [assessment scope](/konvu/administration/assessment-settings.md).

*Example: Semgrep flags `cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")`. If `user_id` comes from a route parameter parsed as an integer, the injection cannot happen and the finding is a False Positive. If it comes from a raw query string, it is Exploitable.*

## Results

Code findings use the same results as dependencies: **Exploitable**, **False Positive**, **Needs input**, and **Inconclusive**. See [How Assessments Work](/konvu/triage-and-remediation/exploitability-assessment/how-assessments-work.md). Every assessment page has an activity timeline and lets you rate the assessment result. See [Reviewing Assessments](/konvu/triage-and-remediation/exploitability-assessment/reviewing-assessments.md).

## Act on the results

* **Dismiss false positives in your scanner.** Dismissals write back to GitHub CodeQL (cloud and self-hosted, which needs the `security_events: write` permission) and GitLab SAST. Reopening a finding in Konvu reopens it in the scanner. ArmorCode receives each assessment result as a comment and a tag. See [Dismissing False Positives](/konvu/triage-and-remediation/triage/dismissing-false-positives.md).
* **Fix exploitable findings.** Select **Generate PR** on an exploitable finding. Konvu writes the fix, runs your tests, and opens a pull request. Plans appear on the Remediate page with dependency fixes. See [Fix Pull Requests](/konvu/triage-and-remediation/remediate/fix-pull-requests.md).
* **Get proof.** For CodeQL findings, and if scanner reproduction is enabled for your organization, you can reproduce the finding in a sandbox. See [Reproducing Scanner Findings](/konvu/triage-and-remediation/exploit-reproduction/reproducing-scanner-findings.md).

## What Konvu does NOT do

* It does not run static analysis itself. Findings come from your scanner.
* It reproduces CodeQL findings only. Other SAST findings are assessed and fixed, but not reproduced.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.konvu.com/konvu/triage-and-remediation/finding-types/code.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.