# Products > Create, rename and delete products, and see every product ranked by open risk with what needs attention first. Source: https://scansuite.eu/documentation/usage/products Last reviewed: 2026-10-19 Every finding, scan and asset is filed under a product, so create one before the first scan. The **Products** page then ranks your products by open risk and says which of them need attention first. ![ScanSuite Products page](https://scansuite.eu/static/assets/img/docs/usage/products/01.png) *The Products page: summary tiles, what needs attention, and open findings over twelve weeks* ## Create a product **Before you start:** your role in the team is operator or team admin. Only they see the **New product** button; readers and vulnerability managers do not. 1. **Click Products in the sidebar** 2. **Click New product** A panel opens under the page title. 3. **Fill in Product name and, optionally, Repository URL (optional)** See the table below. 4. **Click Create product** | Field | What it does | Default | When to change it | |---|---|---|---| | Product name | The name you will search for and see on every finding and report. Required, unique within the team, up to 255 characters. | – | – | | Repository URL (optional) | The repository the product covers, for example https://gitlab.example.com/shop/payments-api. Static analysis findings then link straight to the offending lines. | Empty | Fill it in for a product that is one repository. | **Check it worked:** the message *Product created or updated* appears and the product is listed, marked *Local product* or, when the team uses DefectDojo, *DefectDojo · *. The scan forms now offer it under Product Assignment. - When the team has DefectDojo configured, a DefectDojo product and engagement are created too. If DefectDojo cannot be reached, a warning says so and a local product is created instead. - *Product name is required*: the name was empty. - *Product was not created. Product name should be unique*: another product has the name; pick another. ## Create products without the console A pipeline or a script can create products through the team API, with a team API token whose permissions include `product.write`. The *CI pipeline* token preset includes it. > **A person does this step:** A team admin creates the token: Teams → People tab → **Automation and API tokens**, create a service account with the role Operator (a Reader cannot create products), then **New token** on it with the *CI pipeline* preset. The token is shown once. Put it in the `SCANSUITE_TOKEN` environment variable yourself; never paste it into a chat or hand it to an agent as text. The same card shows the team's name for API addresses (`SCANSUITE_TEAM`). See [CI/CD and automation](https://scansuite.eu/documentation/reference/cicd) for the token dialog. *Create a product* ``` curl -sS -w '\nHTTP %{http_code}\n' -X POST "https:///api/teams/$SCANSUITE_TEAM/products" \ -H "Authorization: Bearer $SCANSUITE_TOKEN" -H "Content-Type: application/json" \ -d '{"product_name": "payments-api", "repository_url": "https://gitlab.example.com/shop/payments-api"}' ``` | Value | Where it comes from | |---|---| | | The address you open ScanSuite at, for example scansuite.example.com. | | $SCANSUITE_TEAM | The team's name for API addresses, on the Automation and API tokens card. | | $SCANSUITE_TOKEN | The token a person created, set in the environment. | | Answer | Meaning | |---|---| | HTTP 201 | Created. The answer names the product and its id; a warning field says when DefectDojo could not be reached and a local product was created. | | HTTP 409 | A product with this name already exists in the team. | | HTTP 403 | The token may not create products: it needs product.write. | | HTTP 400 | The name is empty or longer than 255 characters, or the repository address is not a valid clone address. | **Check it worked:** the product is listed by the API, and on the Products page. *List products by name* ``` curl -sS "https:///api/teams/$SCANSUITE_TEAM/products?search=payments-api" \ -H "Authorization: Bearer $SCANSUITE_TOKEN" ``` The CI client creates the product it is told to scan when the team has none: `--create-product` (or `SCANSUITE_CREATE_PRODUCT=1`) with `--product-name`. It then runs the scan. See [CI/CD and automation](https://scansuite.eu/documentation/reference/cicd). > **Agent prompt: Set up products for a list of repositories** > > ```text > Read https://scansuite.eu/documentation/usage/products. For each repository in , create a ScanSuite product named after the repository, with its URL as repository_url, through the team API (POST /api/teams/$SCANSUITE_TEAM/products on $SCANSUITE_URL). SCANSUITE_URL, SCANSUITE_TEAM and SCANSUITE_TOKEN are already set in the environment; never ask me for the token and never print it. Do not delete or rename anything. If the token is refused, stop and tell me what a person has to change. Report which products were created, which already existed, and any DefectDojo warning. > ``` ## Rename a product Operators and team admins rename a product on the team's product catalog page. Its findings, scans and history stay with the product. 1. **Open the product catalog** On the product page, open the Settings tab and click Rename the product on the team's Products page. The address is https:///t//products, where TEAM is the team's name for API addresses, as above. The page is titled Products, with a Product catalog card. 2. **Find the product** Search product names, or Load more. 3. **Type the new name in its row and click Rename** **Check it worked:** the message *Product renamed.* appears and the row shows the new name. Members without the permission see *Read only* in the Action column. - Choose a name no other product in the team uses. A name that is taken is refused with *Another product in this team already has this name.* (HTTP 409 through the API). - The DefectDojo product, and reports produced before the rename, keep the old name. - Through the API: `PATCH /api/teams//products/` with `{"product_name": "new-name"}`, with the same token permission. ## Reading the summary | Tile or panel | What it shows | |---|---| | Products | How many products there are, and how many were not scanned in the last 30 days. | | Open findings | Every open finding by severity. Resolved, False Positive and Risk Accepted findings do not count. | | Critical open | Open critical findings, and how that number moved in the last 7 days. | | Overdue | Open findings past their due date. See the deadlines in [Vulnerability Management](https://scansuite.eu/documentation/usage/vulnerability-management). | | Verified secrets | Secrets confirmed to be valid, and in how many products. | | Scans, 30 days | Scans started in the last 30 days, how many failed, and the LLM spend. | | Open findings, all products | A chart of open findings across every product over the last 12 weeks, beside Needs attention. | ## What needs attention The **Needs attention** panel lists the most urgent problems across products, worst first. Each item has a button that opens the place to act on it. | Item | What to do | |---|---| | N critical open for more than 14 days | Review the critical findings of that product. | | N verified secrets | Rotate the secrets and remove them from the code. | | last scan failed | Open the scan and read why it failed. | | N findings reopened in 7 days | A fix did not hold; review the findings. | | N findings past their due date | Fix them, or agree a new date and record it. | | not scanned for N days | Scan the product again, or schedule it. | | never scanned | Run its first scan. | The panel shows eight items, and the number beside its title counts them all; filter the list below it to see the rest. ## The product list ![ScanSuite product list](https://scansuite.eu/static/assets/img/docs/usage/products/02.png) *The product list with its filters, sort order and LLM spend* | Column | What it shows | |---|---| | Select box | Selects the product for Delete selected. The box in the header selects every product on the page. | | Product | The name, and Local product or the DefectDojo engagement, which opens it in DefectDojo. | | Risk | The product's risk score (see below) and how it compares with the riskiest product. | | Open findings | Open findings by severity. | | 12-week trend | Open findings at the end of each of the last twelve weeks. | | Coverage | Repositories, web apps and hosts its scans covered, uploads, and its assets. | | Secrets | Verified secrets, and how many were found. | | Last scan | The latest scan, when it ran and how it ended. Under it: Stale (not scanned for more than 30 days), N running, Scheduled (a schedule or monitor is set) or No schedule. Never scanned when there is no scan yet. | | LLM Tokens / Cost | What AI scans of the product have spent. | The risk score weighs each open finding by its severity: a Critical counts 40, a High 10, a Medium 3 and a Low 1. The Top 10 panels on the Vulnerabilities page rank by the same score. Click a product to open its page; see [The product page](https://scansuite.eu/documentation/usage/products/product-page). ## Filtering, sorting and exporting - Filters: **All**, **Critical open**, **Overdue**, **Verified secrets**, **Last scan failed**, **Not scanned 30+ days** and **Not monitored**, each with the number of products it matches. - Search by product name. - Sort by risk (the default), open findings, last scan, name, LLM spend or newest first. - **Export CSV** writes one row for every product, whatever the filter: its risk score, open findings by severity, overdue findings, coverage, secrets, last scan, recent scans and failures, whether it is scheduled, and LLM spend. The filters and the sort order are kept in the page address, so a filtered view can be bookmarked or shared. ## Management report **Management report**, beside Export CSV, builds a report on all products for managers, with the products ranked by risk. | Option | What it does | Default | |---|---|---| | Format | PDF report, to read, send and keep; or Slides (PPTX), ten slides with editable charts, to present. | PDF report | | Period | Last 7 days, Last 30 days, Last 90 days, Last quarter, This quarter to date, Last 12 months or All time. | Last 90 days | | Comment on page 1 | Optional, up to 600 characters: a plan, a commitment, a known cause. | Empty | | Append the list of open Critical and High findings | PDF only. | Off | | Append every product’s scanned repositories | PDF only. | Off | | Download PDF / Download slides | Builds and downloads the report in the chosen format. | – | The owner and business criticality set on a product's Settings tab appear in the report. The company name, logo and classification label come from the **Management reports** card on the **Scanning** tab of the **Teams** page. Every other report is described in [Reports and exports](https://scansuite.eu/documentation/usage/reports-and-exports). ## Deleting products Deleting is for operators and team admins, in the console only. - **Several products:** tick them in the list, click **Delete selected** and confirm. The result says how many were deleted. - **One product:** open its page, Settings tab, type the product's name and click **Delete product**. - A product with a running scan is not deleted. The list says *Not deleted while their scans are running: …*; the product page says to stop its running scans first. > **Deletion is not limited to the product record:** Deleting a product deletes all its findings and secrets, its hosts, its scan records with their schedules and monitors, what its scans spent on LLM calls, and the architecture reports of repositories no other product scans. Custom rules that applied only to this product are switched off. Where the product is linked to DefectDojo, the DefectDojo product is deleted too. There is no undo. ## How to organise products There is no single right answer, but two habits pay off: - One product per application. A product can hold several repositories, web apps and hosts, and its page lists each of them separately. - Keep unrelated applications apart, so risk, trends and deadlines mean something per product.