Triage a finding, compare evidence from different scanners, and review a patch before opening a pull request.
Daybreak allows you to quickly review proposed fixes based on findings from your scans.
Open Overview in Daybreak. Under Proposed fixes, select Review to
inspect a patch. To investigate an issue first, open Findings and select a
finding.
What’s on the findings page?
The chart groups findings by severity and status. The table below it shows who
owns each finding, which scanner reported it, and when it was detected. You
can search the list or filter it by repository.
northline/reporting-api / Findings
Import
Review 1 proposed fix to help reduce vulnerabilities in your code.View fixes
LowErrors include temporary download URLsnorthline/reporting-apiMorgan Dale · Daybreak · Oct 9Morgan DaleDaybreakNewOct 9
Select a finding to see its summary, root cause, and supporting evidence.
The detail page explains how someone could exploit the issue and shows its
reported severity and current status.
Findings / SEC-1034
Fix with Codex
Missing authorization – Asset export
SEC-1034 · asset-servicing
Summary
The export route returns a restricted asset without enforcing the caller’s project membership.
Root cause
The export function receives the caller and the requested resource, but returns the resource without checking that the caller belongs to its project.
Impact and attack path
A caller who can request an export for a resource outside their project could receive that resource’s contents.
Reported severity
Critical
Status
New
New
Triaged
In Progress
Fixed
Won’t fix
Duplicate
False positive
Import findings from other scanners
Open Settings → Integrations. Select Connect to link a scanner or Import to use an existing connection. Check the count, repository, and destination. If the confirmation names a shared destination, confirming authorizes assessment and publication of eligible Reportable results there.
You can save or assess an uploaded report privately, or share eligible results. Reopen My recent imports for the private outcomes. Each shared finding lists the evidence from its scanners under Observations. See Import scanner findings for the steps and limits.
Under Findings, select Fix on a finding to generate a patch. You can also select multiple findings in the list. For example, select two findings and choose Generate 2 fixes. Daybreak prepares the patches in the background. Open Fixes to review them.
Open a proposed fix. Read its summary and diff under Proposed changes. Read the Patch checker result to see what Daybreak verified. For the export issue shown below, look for a test that rejects a request from another project and one that still allows an authorized export.
If you have questions or want a change, choose Fix with Codex from the menu next to Create PR. When the patch is ready for your team, select Create PR to open a draft pull request on GitHub.
FixesCreate PR
Fix: Exports skip project membership checks
Fix status
Proposed
Repository
northline/reporting-api
Summary
Check project membership before exporting a report.
Proposed changes
src/routes/exports.ts
18export async function downloadReport(req, res) {
20+ const member = await projects.hasMember(report.projectId, req.user.id)
21+ if (!member) {
22+ return res.sendStatus(403)
23+ }
24 return res.download(report.file)
25}
Review and test the change in the pull request. After it merges, verify that
the original attack path fails on the merged revision before marking the
finding Fixed.
