> For the complete documentation index, see [llms.txt](https://docs.konvu.com/konvu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.konvu.com/konvu/what-is-konvu.md). # What is Konvu? Konvu triages vulnerability findings from any source and helps you fix the ones that are real. Konvu triages vulnerability findings from any source (scanners, bug bounty programs, pentests, and AI code security tools) and helps you fix the ones that are real. It assesses whether each finding is exploitable in your code, proves it by reproducing the exploit in a sandbox, and prepares a fix pull request you review before anything lands. Many findings a security team receives are not exploitable where they sit: the vulnerable code is never called, an attacker cannot reach it, or a control already blocks it. Konvu separates those from the findings that need action, and every conclusion comes with evidence you can check. ## How it works | Stage | What Konvu does | | ------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **1.** [**Connect your environment**](/konvu/get-started/connect-your-environment.md) | Reads your source code, managed by Konvu or self-hosted, and your cloud accounts for container images. | | **2.** [**Bring in findings**](/konvu/get-started/bring-in-findings.md) | Imports findings from your code and container scanners, bug bounty programs, and external reports such as pentests, scanner exports, and AI code security tool output. | | **3.** [**Triage**](/konvu/triage-and-remediation/triage.md) | Runs an **exploitability assessment** on every finding in scope: an agent checks the conditions for an exploit against your code. When you need proof, an **exploit reproduction** deploys your application in a sandbox and runs the exploit. | | **4.** [**Remediate**](/konvu/triage-and-remediation/remediate.md) | Prepares a remediation plan for exploitable findings, with the diff and what it affects, then opens a fix pull request once you accept it. | | **5.** [**Deliver**](/konvu/triage-and-remediation/monitor-and-deliver.md) | Sends summaries by email and Slack, and forwards assessments to the tools your team already uses, such as ArmorCode and Wiz. | Each kind of finding goes through these stages a little differently. See [Finding Types](/konvu/triage-and-remediation/finding-types.md) for what Konvu checks and does for each one. ## What makes Konvu different **Exploitability, not reachability alone.** Reachability tells you whether vulnerable code is called. That is necessary but not sufficient. Konvu also checks whether the affected runtime applies, whether untrusted input reaches the vulnerable function, and whether that input is validated first. A reachable vulnerability can still be a false positive. **Proof you can check.** For vulnerability reports, and for scanner findings in early access, Konvu reproduces the exploit against its own copy of your application. You get the requests, responses, and observed impact, or the investigation that ruled the vulnerability out. See [Exploit Reproduction](/konvu/triage-and-remediation/exploit-reproduction.md). **Evidence on every assessment.** Each assessment shows the conditions Konvu checked, the code it read, and why it reached its result. When Konvu needs context only you have, such as whether a service is internet-facing, it asks. See [Reading an Assessment](/konvu/triage-and-remediation/exploitability-assessment/reading-an-assessment.md). **Fixes you review first.** Before any pull request opens, a remediation plan shows the target version or code change, the API changes it brings, and the diff. Fixes cover vulnerable dependencies and your own code. See [Remediation Plans](/konvu/triage-and-remediation/remediate/remediation-plans.md). ## What Konvu does NOT do * It does not find vulnerabilities itself. Findings come from your scanners, programs, and reports. The exception is secrets, which Konvu detects in your repositories. * It does not test your live environment. Exploit reproduction runs against a copy of your application in a sandbox Konvu controls. * It does not revoke or rotate credentials. See [Secrets](/konvu/triage-and-remediation/finding-types/secrets.md). * It does not open fix pull requests for container findings or vulnerability reports. Reports get a fix prompt for your coding agent instead. * It does not create tickets. Assessments reach other tools through [data forwarding](/konvu/triage-and-remediation/monitor-and-deliver/data-forwarding.md) to ArmorCode and Wiz. ## Supported stack ### Languages Exploitability assessment supports these languages: | Language | | ----------------------- | | Java / Scala / Kotlin | | Python | | Ruby | | JavaScript / TypeScript | | C# / .NET | | Go | | PHP | | Rust | Fix pull requests support the package managers listed in [Supported ecosystems](/konvu/triage-and-remediation/remediate/fix-pull-requests.md#supported-ecosystems). ### Finding sources See [Bring In Findings](/konvu/get-started/bring-in-findings.md) for every supported scanner, bug bounty program, and report format, and the [Finding Types](/konvu/triage-and-remediation/finding-types.md) coverage matrix for what Konvu does with each kind of finding. ### Source code management platforms | Platform | Status | | -------------------------------- | ----------- | | GitHub / GitHub Enterprise Cloud | Supported | | GitLab | Supported | | Azure DevOps | Coming soon | | Bitbucket | Coming soon | ## Next steps * [Connect your environment](/konvu/get-started/connect-your-environment.md) so Konvu can read your code. * [Bring in findings](/konvu/get-started/bring-in-findings.md) from your scanners, programs, and reports. * [Learn how triage works](/konvu/triage-and-remediation/triage.md) to understand exploitability assessment and exploit reproduction. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.konvu.com/konvu/what-is-konvu.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.