Setup checklist: reachability, security fixes and known exploited
Security › Overview (/<org>/_admin/security/overview) opens with a checklist card for org owners. It shows what reachability, Security fixes and known-exploited triage need from your organisation. Every item is computed from your organisation’s current state each time the page loads. It never just records that you looked.
Each item says what it is, why it matters, its current state, and gives one link. A badge marks it Done, Needs action, Check this or Optional. The heading counts the items that need nothing more from you.
The items
| Item | Current state | Link |
|---|---|---|
| Known-exploited vulnerabilities | How many open dependency findings have a CVE listed as exploited in the wild by ENISA EUVD or CISA KEV. Needs action while there is at least one. | The Dependencies list filtered to known exploited |
| Go binaries built with symbols | Which images have Go binaries built with -ldflags=-s. govulncheck reads no symbol table from them, so their findings stay unknown (no_symbol_table). Needs action while there is at least one. Build without -s; -w is fine. | Reachability: the reasons |
| AI fixes: your own AI provider | Not set, Set (and whether AI fixes are on), or Key rejected when the provider refused the key the last time it was used (HTTP 401 or 403). | AI integrations |
| Security fix limits | The open pull requests allowed per repository and requests per organisation in 24 hours, and whether they are the defaults. Check this when a limit is 0, which turns AutoFix off. A fix pull request opens only when someone clicks Open fix PR, unless automatic security fixes are on. | Security fix limits |
| Alerts: newly reachable or known exploited | On or off for the organisation, with a button to switch it. | Finding alerts |
| SLA multiplier for not-reachable findings | Off, or on with its factor. Optional. | Fix-by SLA |
| Do not block on not-reachable findings | Off, on for every repository, or on for a number of repositories. Optional. | The policy |
| Automatic security fixes | Off or on: on when the Security fixes mode is one of the automatic ones. Optional. | Automatic security fixes |
An optional item that is off is not a problem; it counts as needing nothing more from you.
Hiding it
Hide checklist collapses the card to one line for everyone in the organisation, with a Show checklist button that opens it again. The state is computed again when it is shown, so it is always current. Hiding and showing it is audited as code-security.checklist.updated.
API
GET /_app/api/v1/orgs/{org}/security/checklist (policy:read) returns the checklist as the card computes it now: dismissed, complete, total and the items, each with its id, its status (done, todo, optional or warn) and the facts behind it, for example open for known_exploited or max_open_per_repo for autofix_limits. PUT with {"dismissed": true} or false (policy:write) hides or shows the card.
Auditors
A read-only auditor sees the card. The buttons are refused for auditors, like every change.
See also
- Security digest: security fix outcomes and the week’s newly reachable and known-exploited findings.
- Finding alerts.