Skip to main content
During a white-box scan, the agent reads your code and writes down every possible weakness it notices. Each one is a hypothesis: a short question such as “Can a normal user call the admin export endpoint?” The agent then checks each hypothesis in the code and records the answer. The Hypotheses tab shows this work. It lets you see what the agent checked, not only what it found.

​
How the agent handles hypotheses

1

Collect

The agent reviews the code from several angles: inputs to dangerous operations, login and permission checks, tenant and object access, and other paths to the same action. Every possible weakness becomes a hypothesis.
2

Screen

The agent removes duplicates. It also drops hypotheses about behaviour that the threat model marks as intended, accepted, or out of scope. Then it gives each remaining hypothesis a priority. Hypotheses that an attacker without an account could use come first.
3

Check

The agent checks each hypothesis in the code, highest priority first. It follows the code path, looks at the permission checks and data flow, and decides if the weakness is real.
4

Report

When the agent confirms a hypothesis, it creates a finding with a CVSS score, the affected code location, and a fix. The finding appears in the Findings tab.

​
The Hypotheses tab

Open an application and click the Hypotheses tab. The table has three columns:
  • Hypothesis: the question the agent checked. Below it, a short conclusion explains the result.
  • Location: the repository and the file and line where the agent looked.
  • Outcome: the result of the check.

​
Outcomes

1

Vulnerable

The agent confirmed the weakness in the code. A finding was created for it.
2

Not vulnerable

The agent checked the code and found that the weakness is not real, or it could not show that an attacker can use it. No finding was created.
3

In progress

The agent has not finished checking this hypothesis yet. You see this during a running scan.

​
Find what you need

  • Use Search hypotheses to search by question, conclusion, file path, or repository.
  • Use the Outcome filter to show only Vulnerable, Not vulnerable, or In progress.
  • Use the Scan menu to switch between scans. By default, the tab shows the newest scan that has hypotheses. Retests do not have hypotheses.

​
How to use this tab

  • Check coverage. A long list of Not vulnerable hypotheses on an area such as billing or permissions shows that the agent looked there and found it safe.
  • Find gaps. If an area that matters to you is missing, add it to the Security focus area of the application. The next scan will pay more attention to it.
  • Help your developers. The file and line in the Location column show where to look, even for hypotheses that were not confirmed.
You cannot add or edit hypotheses yourself. To guide the agent, use the scope notes, the application context, the security focus area, or supporting files.
The Hypotheses tab is not turned on for every organization yet. If you do not see it, contact us.