Product

Product Features SDLC How to Compare Docs Screenshots

Start here

Getting started Download Questions

More

Security Roadmap About

Context

Sign off a branch, and let the scans do the rest

Certification exists so that "somebody read this" is a thing the product can hold, and so that a coverage figure means work that is genuinely outstanding rather than every branch that has ever existed.

What to do

  1. Open any finding on the branch you reviewed. Certifying is done from a finding because that is where the repository, the branch and the commit are already in front of you, which is how a review stops being recorded against the wrong branch.

  2. Scroll to the card at the foot of the page. Write what you read, what you checked for, and why you are satisfied. It is required, and twenty characters is the floor: somebody is going to rely on this without being able to ask you.

  3. Set an expiry. It is required as well, because a review with no end date is a claim that nothing will ever change.

  4. Save. The badge appears on every finding on that branch and on the Repositories page, and it turns amber the moment anybody pushes, whether or not the push produced a finding.

  5. Leave the quiet branches alone. A completed scan signs off the branches it found nothing to read on, in its own words, marked as a machine's work. You do not need to click anything for those and you should not.

  6. Check the coverage figure on the dashboard. It is a share of branches, so it moves when work is done rather than when a filter is changed.

Worth knowing

A certification hides nothing and is never a filter. If a certified branch starts producing criticals, every one of them is reported, next to a badge saying the review no longer covers what is there.

Other guides