Security

To log a security finding, choose Security in the project sidebar, then Log finding. Only the title is required: Create Finding stays disabled until there is one.

• Title: what's wrong, like Outdated dependency with known CVE.
• Severity: Critical, High, Medium or Low. New findings are Medium.
• Status: Open, Triaged or Resolved. New findings are Open.
• Detected on: the date it was found. It starts as today's date.
• Affected: the component, service or file path it affects.

New finding, beside the Risk Queue heading, opens the same dialog. A new finding goes to the top of the risk queue.

Every security finding has a severity and a status.

• Severity is how serious it is: Critical, High, Medium or Low.
• Status tracks the work on it: Open, Triaged or Resolved. Every finding that isn't Resolved counts toward Open vulnerabilities.

After you log a finding, only its status can change. To correct its title, severity, date or affected area, delete it and log it again.

The figures across the top of Security are Policies enabled (how many of the project's policies are on, out of all of them), Open vulnerabilities (findings that aren't Resolved), Denied access (access events with the result Denied) and Active keys (keys that aren't revoked). Search and filters don't change them.

The tabs under the figures choose what the screen shows:

• Overview: everything, one part after another.
• Access: Access Controls and Recent Access.
• Vulnerabilities: the Risk Queue, with its severity and status filters.
• Keys: Keys & Tokens.

Each list pages on its own, 10 rows a page unless the project's default is changed under Settings → General → Default rows per page. Choose 10, 25, 50 or 100 at the bottom of a list to change it there.

The Risk Queue on the Security screen lists the project's findings, newest first. Each row shows the title with the first eight characters of its ID, the affected area, severity, status and the date it was detected.

On the Vulnerabilities tab, filter by severity (All severities, Critical, High, Medium or Low) and by status (All statuses, Open, Triaged or Resolved). Search security items matches findings by title, affected area, severity and status. It doesn't filter access events or keys.

Each row's ⋯ menu moves the finding along: Mark triaged on an Open finding, Mark resolved on any finding that isn't Resolved, and Reopen, which sets a Resolved finding back to Open. Delete asks you to confirm first, and a deleted finding can't be restored from Flow.

Access Controls, on the Access and Overview tabs of Security, lists the project's security policies. Each one shows its name, the scope it covers and its mode, Monitor or Enforce. A project without policies shows No policies yet.

The switch on each policy turns it on or off. The change saves straight away and updates Policies enabled. Policies can't be added, edited or deleted from Flow, and turning one on doesn't make Flow block or allow anything: the mode and the switch are a record for your team.

Recent Access, on the Access and Overview tabs of Security, lists the project's access events, newest first: who acted, what they did, its target, when, and the result, Allowed or Denied.

Flow records one kind of event here: creating a key on the Keys tab. The entry names you by your email as the actor, api_key.create as the action, and the key's name and prefix as the target, with the result Allowed. Access events can't be added, edited or deleted from the screen.

To record a project key, choose Create key at the top of Security, or New key beside the Keys & Tokens heading. Only the name is required: Create Key stays disabled until there is one.

• Name: what the key is for, like CI deploy token.
• Scopes: choose any of read, write, deploy and admin. Choose a scope again to remove it.
• Key prefix: generated by Flow, gfk_ followed by six characters. You can't change it.
• Expires: an optional expiry date.

Flow stores the name, prefix, scopes and expiry date. It doesn't generate or store a full secret, and nothing in Flow signs in with the key. Keys are listed newest first with their scopes, expiry date and status, Active or Revoked. A key stays Active after its expiry date until you revoke it.

Each row's ⋯ menu has Revoke key (or Restore key on a revoked key) and Delete. Delete asks you to confirm first, and a deleted key can't be restored from Flow.