> ## Documentation Index
> Fetch the complete documentation index at: https://docs.noscope.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Hypotheses

> A hypothesis is a possible weakness that the agent found in your source code and then checked. The Hypotheses tab shows every one, with its result.

During a white-box scan, the agent reads your code and writes down every possible weakness it notices. Each one is a hypothesis: a short question such as "Can a normal user call the admin export endpoint?" The agent then checks each hypothesis in the code and records the answer.

The Hypotheses tab shows this work. It lets you see what the agent checked, not only what it found.

## How the agent handles hypotheses

**1. Collect**

The agent reviews the code from several angles: inputs to dangerous operations, login and permission checks, tenant and object access, and other paths to the same action. Every possible weakness becomes a hypothesis.

**2. Screen**

The agent removes duplicates. It also drops hypotheses about behaviour that the threat model marks as intended, accepted, or out of scope. Then it gives each remaining hypothesis a priority. Hypotheses that an attacker without an account could use come first.

**3. Check**

The agent checks each hypothesis in the code, highest priority first. It follows the code path, looks at the permission checks and data flow, and decides if the weakness is real.

**4. Report**

When the agent confirms a hypothesis, it creates a finding with a CVSS score, the affected code location, and a fix. The finding appears in the Findings tab.

## The Hypotheses tab

Open an application and click the **Hypotheses** tab. The table has three columns:

* **Hypothesis**: the question the agent checked. Below it, a short conclusion explains the result.
* **Location**: the repository and the file and line where the agent looked.
* **Outcome**: the result of the check.

## Outcomes

**1. Vulnerable**

The agent confirmed the weakness in the code. A finding was created for it.

**2. Not vulnerable**

The agent checked the code and found that the weakness is not real, or it could not show that an attacker can use it. No finding was created.

**3. In progress**

The agent has not finished checking this hypothesis yet. You see this during a running scan.

## Find what you need

* Use **Search hypotheses** to search by question, conclusion, file path, or repository.
* Use the **Outcome** filter to show only Vulnerable, Not vulnerable, or In progress.
* Use the **Scan** menu to switch between scans. By default, the tab shows the newest scan that has hypotheses. Retests do not have hypotheses.

## How to use this tab

* **Check coverage.** A long list of Not vulnerable hypotheses on an area such as billing or permissions shows that the agent looked there and found it safe.
* **Find gaps.** If an area that matters to you is missing, add it to the **Security focus area** of the application. The next scan will pay more attention to it.
* **Help your developers.** The file and line in the Location column show where to look, even for hypotheses that were not confirmed.

You cannot add or edit hypotheses yourself. To guide the agent, use the scope notes, the application context, the security focus area, or supporting files.

> [!NOTE]
>
> The Hypotheses tab is not turned on for every organization yet. If you do not see it, contact us.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.