Skip to content

Interpret Results

Start with the operation, confirm the evidence, and then read the assessment and next actions. Use the dimension pages for result categories and their limits; this page explains how to investigate a result in the report views.

Review a result

  1. Open a selection from Assessment, or filter Crypto Functions or Operation Groups.
  2. Confirm the source file, operation, and identified library.
  3. Inspect the parameters, their units, and the evidence behind the values.
  4. Read each relevant dimension under Assessment, then its explanation under Reasoning.
  5. Review Discovery follow-ups, Assessment review, and Remediation before defining a change.
  6. Record the decision in your tracking system, test changes, and rescan to obtain new results.

Selecting a row or assessment label opens its details. In VS Code, detailed review is available in Crypto Details; Eclipse provides embedded details. Use Expand reasoning where available to read the full explanation and related evidence. In the standalone viewer, expand the relevant function or group.

Parameter evidence

State Reviewer interpretation
DETECTED A parameter or relevant source expression was found. This alone does not establish its final value.
RESOLVED The available evidence establishes the reported value.
DYNAMIC_OR_UNRESOLVED The expression was seen, but its final value remains unknown.
MISSING No evidence for the parameter was obtained.

Detection, resolution, and assessment are different questions. A resolved value can still be insecure. An unresolved setting needs investigation rather than a safe or unsafe assumption.

In parameter details, use the value's evidence type and source locations to distinguish a source setting from a documented default or runtime input. Follow the displayed evidence path when available. If you inspect the JSON directly, the relevant fields include resolution, evidenceKind, flowPath, and policyFindings.

Confidence describes the reported evidence; it does not certify the result or replace missing application context. Check whether a length is in bits or bytes before comparing values.

Open the matching operation group when earlier setup explains a call's settings. Follow the source sequence and inspect each contributing location. For a conflict or unknown replacement, confirm which setting actually applies before deciding on remediation.

Discovery and Inventory explains the supported reuse behavior. Operation Groups explains the view and the information it contains.

Read compact labels with their explanations

A dash means no additional compact detail is shown. No CWE, Not assessed, and Needs more evidence express different outcomes; none is an application-wide pass. Open the relevant dimension to read its scope and explanation. A follow-up such as Review quantum strength is an action, not a replacement quantum category.

Legacy Quantum vulnerable call/file counts include the QUANTUM_BROKEN category. The current Assessment overview's quantum-exposure group count also includes weakened uses. Check the label, unit, and summary definition before comparing totals.

Check an empty or incomplete result

Confirm that the scan completed, the intended source was included, and the language selection was correct. Review exclusions and warnings. Unsupported APIs and runtime-only settings can limit the inventory or assessment. An absent field in an older report is not a new scanner conclusion; regenerate the scan when newer details are needed.