Findings lifecycle

What it is

Every finding is a stateful entity with a lifecycle, not a one-time artifact. Status moves from open → in_progress → fixed → verified as your team works it, with wontfix for accepted risk. Each finding can be assigned to a teammate and given a due date so the queue ranks itself.

What it produces

Per finding:

• Status: open / in_progress / fixed / verified / wontfix (five states covering the full remediation arc).
• Assignee: any user in the workspace. Filter the list by “Mine” to split work across a team.
• Due date: optional. Overdue items float to the top of the executive dashboard.
• History: every status change is stamped with actor + timestamp + before/after, the audit trail behind the badge.
• Bulk actions: select N rows, change status / assignee / due date on all of them at once.

What to use it for

• Run a real remediation program, not a one-time triage exercise.
• Split a backlog across a team without setting up saved views.
• Hit a fix-by-Friday deadline by setting due dates and watching overdue counts.
• Hand a CISO an answer to “what did we close last quarter” by filtering closed-in-window.

Why it matters

A raw findings list is a snapshot. A lifecycle turns it into a workflow. Without state, every standup re-asks “who’s on this?” and “is this fixed?” The answer lives in someone’s head, not the system. With state, the dashboard is the answer.

Why it’s valuable

• Five-state model, not just open/closed. fixed (the team thinks it’s done) is distinct from verified (the security team confirmed the fix held). That gap is where regressions hide.
• History never goes away. Even on hard-deleted findings the status transitions stay in the audit table so post-incident review has data to work with.
• Bidirectional with Jira / GitHub. Close a ticket → finding closes; close a finding → ticket transitions. See bidirectional sync.
• MTTR comes free. The closed-at timestamp turns into median time-to-remediate on the executive dashboard.

How to use it

• Open any finding → the drawer’s header shows the current status with a one-click dropdown to change it.
• Assignee picker + due-date picker live beside the status badge.
• Bulk action bar appears when one or more rows are checked. Change status, assignee, or due date across the selection.
• Lifecycle filter row on the findings page: Active (the working queue) / Open / In progress / Fixed / Verified / Won't fix / Mine.