Team Security

The Security page is scoped to a team and groups code findings, AI endpoint findings, hardening controls, and the workspace audit log. Available tabs depend on workspace entitlements and, for the audit log, the signed-in user's workspace role.

Open the security page

  1. Open the required team.
  2. Select Security from the team navigation.
  3. Start on OWASP Top 10 to review code-security findings.
  4. Open Non-OWASP Controls to review hardening controls when your plan includes the security entitlement.
  5. Open OWASP LLM Top 10 to review AI endpoint findings when your plan includes aiRedTeam.
  6. Open Audit Log when the workspace has the auditLog entitlement and your role is Owner or Admin.

Tabs hidden by an entitlement or role cannot be opened from this page. The server enforces these checks as well as the page, so the visible navigation is not the security boundary.

Security page navigation showing the OWASP Top 10 view

Findings and controls

The OWASP Top 10 view groups findings by category; expand a category to inspect finding titles, locations, severity, and status. The Non-OWASP Controls view groups controls by domain; expand a control to inspect its threat/goal and source. For a missing control, + Task creates a remediation task in the team's default project. These views are not a live scan of the repository: the page presents findings and control data published to iKanban.

For a local code scan, select Scanner to download the standalone repository scanner. Run it against your own repository from your machine. The scanner can publish results back to this page when run with --publish.

For AI endpoint testing, select AI scanner from the OWASP LLM Top 10 view. It runs from your machine against your own AI endpoints and covers prompt injection, data disclosure, and excessive agency. Results can be published with --publish.

Review the scanner instructions before running either tool. A scan run is separate from viewing the findings page; downloading a scanner does not start a scan or publish results.

Audit log

The audit log is workspace-wide, even though it appears within a team page. It is sorted newest first, supports filtering and search, and retains events for 90 days. Use CSV to export the currently filtered rows. This view is available only to workspace Owners and Admins with the required entitlement.

Related guidance

See Data Security for how configured AI provider keys and notification text are handled. See Members & Roles for team membership and role guidance.