Making it usable
Exclusions and exceptions
Every way of setting a finding aside carries who decided, why, and when it lapses.
Three instruments, deliberately different
An exception covers one finding and is a decision somebody signed. An exclusion is a rule covering whatever matches it, now and later. A rule mute sets aside a class of finding entirely and needs a second person to agree, because it hides everything that rule will ever produce.
Scoped to what the system holds
An exclusion can say what it was not written for. On a connection carrying cardholder data the finding comes back, with the reason it was let through elsewhere still on the record. An exception can be broad without being blind.
Nothing is deleted
An excluded finding still appears in the scan output with the reason and the reviewer attached. It leaves the work list, not the record.
By value, not just by place
A credential can be excluded by its fingerprint, which is a hash of the value. The same key committed to another repository is the same fingerprint, so the decision follows the secret rather than the location.
What it does not do
An exclusion with no expiry is permanent until somebody notices. The page counts the expired ones and offers to clear them, and it cannot make anybody look.
Every feature page carries one of those. The comparison page scores the same ground against five products people pay for, including the rows that go against us.