Security Findings

Shoehorn tracks security findings for entities in your catalog, aggregating vulnerability data and security posture information.

What’s Tracked

Finding Type	Source	Description
Dependabot alerts	GitHub	Vulnerable dependency versions
CodeQL findings	GitHub	Static analysis security issues
Secret scanning	GitHub	Exposed secrets in code
Custom findings	API	Manually reported vulnerabilities

Viewing Findings

Per Entity

Navigate to an entity detail page to see its security posture:

• Active vulnerability count by severity
• Whether security tools are enabled
• Recent finding history

Scorecard Integration

The security scorecard category evaluates:

Rule	Points	What’s Checked
dependabot-enabled	5	Dependabot is active on the repository
codeql-enabled	5	CodeQL scanning is configured
secret-scanning	5	Secret scanning is enabled
no-critical-vulns	5	No unresolved critical/high vulnerabilities

Governance Integration

Security findings can automatically create governance actions:

• Critical vulnerabilities create critical priority actions
• High vulnerabilities create high priority actions
• Actions are assigned to the entity’s owning team
• SLA timers track remediation progress

Security Best Practices

For optimal security posture in your organization:

1. Enable Dependabot on all repositories
2. Configure CodeQL for supported languages
3. Enable secret scanning with push protection
4. Review findings regularly via the governance dashboard
5. Set SLA targets for vulnerability remediation