Import third-party security findings

If you already use third-party static analysis or vulnerability scanning tools, you can import findings directly into CodeMender to proceed immediately to verification and patching.

Import security reports

CodeMender parses external security reports and registers findings in its local database.

Import a JSON findings file

To import findings from a JSON file, use the --file (or -f) flag. The JSON file must conform to the following schema:

[
  {
    "file_path": "src/auth/session_manager.py",
    "line": 42,
    "title": "SQL Injection",
    "message": "Raw user input concatenated in SQL query",
    "severity": "HIGH",
    "vuln_type": "CWE-89"
  }
]

Run the import command:

cm report import --file ./findings.json

Interactive import mode

If you don't have a JSON file, you can run the import command without the --file flag to enter an interactive wizard in your terminal:

cm report import

Follow the prompts to enter the path, line number, severity, and description for each finding. Enter q at any prompt to finish and save.

Process imported findings

After importing external findings:

Run cm report to view the list of registered findings and obtain their generated <finding-id> values.
Execute verification on an imported finding to generate a proof-of-concept exploit:
```
cm verify FINDING_ID
```
Generate and validate a security patch for the finding:
```
cm fix FINDING_ID
```