> ## Documentation Index > Fetch the complete documentation index at: https://docs.porcia.org/llms.txt > Use this file to discover all available pages before exploring further. # Findings > Security posture checks across your SaaS stack — with risk levels, group-by views, and guided remediation. **Findings** is a top-level item in the sidebar at `/findings`. It surfaces security posture issues across your apps, user accounts, OAuth grants, and browser extensions. Each finding has a risk level, context, and a clear path to remediation. ## The Findings page ### Group-by The first thing to configure is how findings are grouped. Use the Group By selector in the top bar: | Group By | What it shows | | ---------------- | ---------------------------------------------------------------------- | | **Finding name** | All instances of the same check type collapsed under one row (default) | | **App** | Findings grouped by the app they relate to | | **Resource** | Grouped by the specific resource (user, grant, extension) | | **None** | Flat list, one row per finding instance | When grouped, rows are expandable — click any group to see individual finding instances. ### Filters Narrow findings using the filter panel (click the filter icon): **Result** * Failed * Passed * Unknown **Severity** * High * Medium * Low **Status** (multi-select) * Open * In Progress * Verifying * Resolved * Reopened * Muted * Accepted **Risk category** (multi-select) * Identity * Configuration * Integration * Data * Supply chain * Governance **Search** — free text across finding names and descriptions. ### Table columns | Column | What it shows | | ------------ | ----------------------------------------------- | | **Finding** | Name with severity dot and instance count badge | | **App** | App the finding relates to (if applicable) | | **Checked** | When the check last ran | | **Result** | Failed / Passed / Unknown badge | | **Severity** | High / Medium / Low badge | | **Category** | Risk category badge | | **Status** | Current workflow status | ### Export Click **Export CSV** to download the current filtered view. ## What findings check Findings cover several risk categories. Examples of what gets flagged: **Identity** * User accessing an app without SSO enforcement * Deprovisioned directory user with active app access * No MFA on a high-risk application **Integration** * High-risk OAuth grant (broad scopes + stale) * OAuth grant from an app with a known breach * Unused OAuth grant (90+ days with no activity) **Supply chain** * Browser extension with `` host permission * Sideloaded extension (not from Chrome Web Store) * Extension with permission escalation since last scan * Extension denied by policy still active on a device **Configuration** * App in use with no owner assigned * App with active spend but no contract on file **Governance** * Shadow IT app with multiple active users and no approval decision * Access request open with no action for 7+ days ## Working with findings ### Opening a finding detail Click any finding row to open the detail panel on the right side of the page. The panel shows: * Full description and why it matters * Affected resource (app, user, grant, or extension) with a direct link * Evidence — the specific data that triggered the finding * Remediation steps ### Updating status From the detail panel, update the finding's workflow status: **Open → In Progress** — mark it as being worked on **In Progress → Resolved** — mark it as fixed; Porcia will verify on the next check run **Open → Muted** — suppress without full resolution (e.g. known false positive) **Open → Accepted** — accept the risk with a mandatory justification note ### Running checks manually From the findings page empty state or via the **Run security checks** button, you can trigger an immediate re-evaluation instead of waiting for the next scheduled run. ## Finding lifecycle Findings are created by the check engine on a schedule. If a finding is resolved and the underlying issue recurs (e.g. the same OAuth grant gets re-authorized), the finding reopens automatically with a **Reopened** status. Accepted-risk findings have a review date — they reopen automatically when the review date passes so the decision gets reconsidered periodically. ## Notifications Set up a [Rule](/governance/rules) to get notified when new findings are created matching specific criteria — for example, alert the security team in Slack whenever a new Critical finding is opened. ## Next steps Manage the third-party access behind many findings Auto-alert on new findings Browser extension signals behind supply chain findings Automate finding remediation workflows