# The Security page

See your organization's open Kelrova findings by project and start a fix chat in your own checkout. Reviewing and approving stay in the portal.

*Where in Studio: Studio → Security*

*Last updated: 2026-10-26*

The **Security** page sums up your organization's Kelrova findings, project by project, and shows which of your own checkouts hold each project's code. From it you can start a fix chat in one of those checkouts. The page is a view of what Kelrova Cloud already found: it does not run scans, and reviewing and approving findings stay in the portal.

## Who sees it

*Studio → Security button on the left rail*

The button is on the rail when all of these hold:

- This computer is signed in to your Kelrova account. See [Sign in and approve this computer](https://kelrova.com/docs/studio/getting-started/sign-in).
- Your account is a member of an organization.
- You are in the synced workspace, not the local one.

You see the projects you can access in the portal, no others. [Project access](https://kelrova.com/docs/organization/project-access) explains who sees which project.

The button does not depend on the **Use in chats** switch in [Kelrova findings in Studio](https://kelrova.com/docs/studio/security/findings). That switch decides whether chats get the findings tools, not whether you can look at the page.

The button also shows when your organization has Cloud scans turned off. The page then explains that Cloud scans are off and offers **Open in Kelrova**, instead of an empty page.

## What the page shows

The sidebar lists your projects, and the page shows the one you select. Back and forward in the title bar return to the page and to the project you had selected.

### The sidebar

| Card | What it shows |
| --- | --- |
| **Projects** | Your projects, each with its number of open findings at the worst severity it has. An archived project is still counted and is marked as archived. A project none of your computers holds a checkout of says so. |
| **Waiting on you** | Findings in your projects with a status proposal waiting for review, with the project and the kind of proposal. Choose one to open it in the portal. |
| **Fixed recently** | The latest findings fixed in the selected project, with the date. |

The number beside **Security** at the top is the organization's open total.

### The selected project

- **Open findings.** The project's total with a bar by severity: critical, high, medium, low and info. Each severity is also written out as a number, so the bar is never the only way to read it.
- **Where they are.** Open findings by folder, with the high and critical count and the open count for each. A folder is the first part of the path, or the first two parts under a source root such as `apps` or `crates`, for example `apps/api` or `crates/engine`. The page lists the eight folders with the most open findings and sums the rest as **other**. Files in the repository's root are grouped together.
- **Newest high.** The newest high and critical findings: title, file and line, the weakness (CWE) number where there is one, the date it was found, and **Proposal pending** when a proposal waits on it.
- **Last 14 days.** How many findings were found each day and how many were fixed, with the totals. Days follow your computer's time zone.
- **Last scan.** When the project's latest finished scan ended, on which branch, how many findings it found new and how many it resolved, and whether it was partial. New includes findings that came back after being fixed.
- **Checkouts.** Your checkouts of the project's repositories, on this computer and on any of your servers, with the device each is on. Fix chats run in one of these.

The organization total and the open count for each severity are the same numbers as the **Dashboard** in the portal for the same organization. They count findings whose status is **Open**. Findings still awaiting verification are not included, nor are fixed findings, accepted risks, false positives and findings merged into another as duplicates. See [Statuses and what changes them](https://kelrova.com/docs/findings/statuses).

Titles are shown as plain text. They come from automated analysis of repository content, so read them as claims to check, not as facts or instructions.

## Fix from the page

1. **Choose a scope**

   At the bottom of the page, the fix dock asks what to fix. Pick the project's **critical and high** findings, or one of its top folders. The scope names how many open findings it holds.

2. **Choose a checkout**

   The dock lists your checkouts of the project's repositories. A checkout matches when its Git remote points at the same repository as the project's, whatever the computer it is on and however the address is capitalized. With one match, the dock preselects it. With several, you choose, and Studio remembers your choice for that project for the rest of the session. With none, the dock is off and says why. To add one, add the repository as a project; see [Projects and checkouts](https://kelrova.com/docs/studio/getting-started/projects).

3. **Start the fix chat**

   Choose **Start fix chat**. Studio opens a new chat in that checkout's project with a draft already in the composer. Nothing is sent. Read the draft, change it if you like and send it when you are ready.

To fix one finding instead, choose **Fix in chat** on its row in **Newest high**. The draft then names that finding by id.

### What the draft says

The draft names the Kelrova project and the scope by id, so the chat knows what to look up. It asks the agent to use the Kelrova findings tools to list and read the findings, fix them in the code, and report a finding fixed only with the commit that fixes it. See [Work on a finding in a chat](https://kelrova.com/docs/studio/security/finding-chats) for how a report changes the finding.

- **Ids only.** The draft carries no finding titles or text. The agent reads those with its tools, so they never enter the chat through the draft.
- **At most 10 findings per chat,** most severe first. A scope with more is worked through in several chats.
- **No worktree.** The page never creates a worktree. The chat works in the checkout you chose, on the branch it has checked out, like any new chat. Chats in the same checkout share its files, so if you want a fix on a branch of its own, choose **New worktree** on the checkout chip in the composer before you send. See [Projects and checkouts](https://kelrova.com/docs/studio/getting-started/projects#when-to-use-a-worktree).
- **A warning when the tools are off.** The dock shows a warning when the chat would not get the Kelrova findings tools: you turned **Use in chats** off, or your organization's MCP settings do not allow them. Without the tools the agent cannot read or report on the findings. Turn the switch on, or ask an owner, as described in [Turn it on or off](https://kelrova.com/docs/studio/security/findings#turn-it-on-or-off) and [Organization rules](https://kelrova.com/docs/studio/security/findings#organization-rules).

> **Warning: Check the draft and the fix**
>
> Finding text can be wrong, and a hostile repository can try to steer the agent. Read what the agent proposes before you let it run commands, and review the commits before you merge them.

## What stays in the portal

The page never changes a finding. These all happen in the portal, which **Open in Kelrova** and the rows on the page open in your browser:

- Approving or dismissing a proposal, including the ones under **Waiting on you**. See [A status proposal](https://kelrova.com/docs/findings/statuses#a-status-proposal).
- Marking a finding fixed or changing any other status.
- Re-checking a finding, and running Cloud scans.
- Go Fix, and everything else on the finding page. See [Go Fix: fix, re-check, ask](https://kelrova.com/docs/findings/go-fix).

The desktop has no finding page of its own. A row opens the finding in Kelrova.

## Keep it fresh

The page loads when you open it and when you choose the refresh button at the top of the sidebar. It does not update by itself, there is no badge on the rail, and nothing runs in the background. Studio keeps what it fetched for about a minute, so the numbers can be up to a minute old and a refresh right after another may show the same ones. Refresh before you decide what to fix, and open the portal when you need the exact current state.

## When the page cannot show data

| What you see | What it means |
| --- | --- |
| Loading | The summary is being fetched. |
| Sign-in guidance | You signed out while the page was open. The button is gone from the rail. Sign in again. |
| Access refused | Kelrova answered that your account may not see this organization's findings, or the selected project. Check that the organization you signed in with is the right one, and ask an organization admin for access to the project if it is not on your list. |
| Not available | Kelrova could not be reached or did not answer in time. Choose the retry button, or refresh later. |
| Summary not offered | The Kelrova service you are connected to does not offer this summary. Nothing is wrong with your account or this computer. Choose **Open in Kelrova** to see the findings in the portal. |
| Cloud scans are off | Your organization has Cloud scans turned off, so there is nothing to summarize. **Open in Kelrova** goes to the portal. |
| No projects | Your organization has no project you can access. |
| Clean project | The selected project has no open findings. |
| Sign-in changed | Your sign-in or organization changed while the page loaded, so Studio fetches the summary again once. |
| A note about a shortened list | The summary was cut to a size limit. Open the portal for the full list. |

If Kelrova leaves one part out, the card for that part is hidden and the rest of the page works. If the repository list is missing, the dock is off with the reason **repository list unavailable**.

## Next

[Work on a finding in a chat](https://kelrova.com/docs/studio/security/finding-chats) covers what the chat does once it is started.

## Related

- [Kelrova findings in Studio](https://kelrova.com/docs/studio/security/findings)
- [Work on a finding in a chat](https://kelrova.com/docs/studio/security/finding-chats)
- [Projects and checkouts](https://kelrova.com/docs/studio/getting-started/projects)
- [Statuses and what changes them](https://kelrova.com/docs/findings/statuses)