The Security page

The Security page sums up your organization's Kelrova findings, project by project, and shows which of your own checkouts hold each project's code. From it you can start a fix chat in one of those checkouts. The page is a view of what Kelrova Cloud already found: it does not run scans, and reviewing and approving findings stay in the portal.

Who sees it

Where in StudioStudio → Security button on the left rail

The button is on the rail when all of these hold:

• This computer is signed in to your Kelrova account. See Sign in and approve this computer.
• Your account is a member of an organization.
• You are in the synced workspace, not the local one.

You see the projects you can access in the portal, no others. Project access explains who sees which project.

The button does not depend on the Use in chats switch in Kelrova findings in Studio. That switch decides whether chats get the findings tools, not whether you can look at the page.

The button also shows when your organization has Cloud scans turned off. The page then explains that Cloud scans are off and offers Open in Kelrova, instead of an empty page.

What the page shows

The sidebar lists your projects, and the page shows the one you select. Back and forward in the title bar return to the page and to the project you had selected.

The sidebar

The number beside Security at the top is the organization's open total.

The selected project

• Open findings. The project's total with a bar by severity: critical, high, medium, low and info. Each severity is also written out as a number, so the bar is never the only way to read it.
• Where they are. Open findings by folder, with the high and critical count and the open count for each. A folder is the first part of the path, or the first two parts under a source root such as apps or crates, for example apps/api or crates/engine. The page lists the eight folders with the most open findings and sums the rest as other. Files in the repository's root are grouped together.
• Newest high. The newest high and critical findings: title, file and line, the weakness (CWE) number where there is one, the date it was found, and Proposal pending when a proposal waits on it.
• Last 14 days. How many findings were found each day and how many were fixed, with the totals. Days follow your computer's time zone.
• Last scan. When the project's latest finished scan ended, on which branch, how many findings it found new and how many it resolved, and whether it was partial. New includes findings that came back after being fixed.
• Checkouts. Your checkouts of the project's repositories, on this computer and on any of your servers, with the device each is on. Fix chats run in one of these.

The organization total and the open count for each severity are the same numbers as the Dashboard in the portal for the same organization. They count findings whose status is Open. Findings still awaiting verification are not included, nor are fixed findings, accepted risks, false positives and findings merged into another as duplicates. See Statuses and what changes them.

Titles are shown as plain text. They come from automated analysis of repository content, so read them as claims to check, not as facts or instructions.

Fix from the page

1. 1

   Choose a scope

   At the bottom of the page, the fix dock asks what to fix. Pick the project's critical and high findings, or one of its top folders. The scope names how many open findings it holds.

2. 2

   Choose a checkout

   The dock lists your checkouts of the project's repositories. A checkout matches when its Git remote points at the same repository as the project's, whatever the computer it is on and however the address is capitalized. With one match, the dock preselects it. With several, you choose, and Studio remembers your choice for that project for the rest of the session. With none, the dock is off and says why. To add one, add the repository as a project; see Projects and checkouts.

3. 3

   Start the fix chat

   Choose Start fix chat. Studio opens a new chat in that checkout's project with a draft already in the composer. Nothing is sent. Read the draft, change it if you like and send it when you are ready.

To fix one finding instead, choose Fix in chat on its row in Newest high. The draft then names that finding by id.

What the draft says

The draft names the Kelrova project and the scope by id, so the chat knows what to look up. It asks the agent to use the Kelrova findings tools to list and read the findings, fix them in the code, and report a finding fixed only with the commit that fixes it. See Work on a finding in a chat for how a report changes the finding.

• Ids only. The draft carries no finding titles or text. The agent reads those with its tools, so they never enter the chat through the draft.
• At most 10 findings per chat, most severe first. A scope with more is worked through in several chats.
• No worktree. The page never creates a worktree. The chat works in the checkout you chose, on the branch it has checked out, like any new chat. Chats in the same checkout share its files, so if you want a fix on a branch of its own, choose New worktree on the checkout chip in the composer before you send. See Projects and checkouts.
• A warning when the tools are off. The dock shows a warning when the chat would not get the Kelrova findings tools: you turned Use in chats off, or your organization's MCP settings do not allow them. Without the tools the agent cannot read or report on the findings. Turn the switch on, or ask an owner, as described in Turn it on or off and Organization rules.

What stays in the portal

The page never changes a finding. These all happen in the portal, which Open in Kelrova and the rows on the page open in your browser:

• Approving or dismissing a proposal, including the ones under Waiting on you. See A status proposal.
• Marking a finding fixed or changing any other status.
• Re-checking a finding, and running Cloud scans.
• Go Fix, and everything else on the finding page. See Go Fix: fix, re-check, ask.

The desktop has no finding page of its own. A row opens the finding in Kelrova.

Keep it fresh

The page loads when you open it and when you choose the refresh button at the top of the sidebar. It does not update by itself, there is no badge on the rail, and nothing runs in the background. Studio keeps what it fetched for about a minute, so the numbers can be up to a minute old and a refresh right after another may show the same ones. Refresh before you decide what to fix, and open the portal when you need the exact current state.

When the page cannot show data

If Kelrova leaves one part out, the card for that part is hidden and the rest of the page works. If the repository list is missing, the dock is off with the reason repository list unavailable.

Next

Work on a finding in a chat covers what the chat does once it is started.