The product page
Everything one product has scanned, the latest report of each target, and its findings, scans, assets and secrets.
Click a product on the Products page to open its own page: every repository, web app and host its scans covered, the latest report of each, and a summary of its findings, scans, assets and secrets.
The summary
Under the name, the DefectDojo pill shows the engagement of a product linked to DefectDojo and opens it; a product that is not linked says Local product. The next pill counts the repositories, web apps and hosts its scans covered, Scheduled means a schedule or monitor is set, and N running counts scans in progress.
| Tile | What it shows |
|---|---|
| Risk score | The weighted score of its open findings, and its rank among all products. |
| Open findings | Open findings by severity. |
| Since the last scans | New, fixed and reopened findings in the latest finished scan of each target. |
| Mean time to fix | The average time from first seen to resolved, over findings resolved in the last 90 days. |
| Overdue | Open findings past their due date. |
| Verified secrets | Secrets confirmed to be valid, and how many were found in total. |
| LLM spend | What AI scans of the product have cost, with the tokens. |
Repositories and targets
The Repositories & targets tab lists everything the product's scans looked at. Switch between Repositories, Web apps and Hosts & networks (and Uploaded code when code was uploaded as an archive).
- A repository is one row across all its branches. The same repository entered with and without
.gitis still one row. - Web app and host targets scanned together are one row, because their report covers them together.
Each row shows the last scan with its branch, commit and mode, the open findings, what the latest finished scan changed, the schedule, and the latest report.
If the latest scan of a target failed, Report still offers the last report that exists and says which date it is from.
Click a row to see the target's last ten scans, each with its report and what it changed. When the target has more, All in Scan History opens the full list. Beside the scans, About this target shows:
| Fact | What it shows |
|---|---|
| Framework, Authentication | Repositories: what the security architecture analysis found, when a scan ran it. |
| Files analyzed, last scan | Repositories: how many files the latest scan read. |
| Branch | Repositories: the branch of the latest scan. |
| LLM spend, this repository | Repositories: what AI scans of this repository have cost. |
| Targets | Web apps and hosts: the targets scanned together in this row. |
| Scans | How many scans covered the target. |
| Schedules | Each schedule or monitor of the target, with its next run, or Paused. |
- View findings opens the Vulnerabilities page filtered to the product and this target.
- Rescan asks Scan again? and repeats the target's last scan with the same scanners, mode and branch. It is not offered while the target is being scanned, nor to members who cannot start scans.
Downloading every latest report
Download latest reports downloads one ZIP with the newest report of every target: a folder per target (repository/…, web/…, host/…), each holding that target's report as <date>-<scan id>.zip. The button is disabled until a scan of the product has a report. Each download is recorded in the team's activity log.
Starting a scan for this product
New scan opens Static Code Analysis, Web App Scanning or Infrastructure Checks with this product already chosen. When the product has repositories, the same menu offers Rescan all repositories: it repeats the latest scan of each repository with the same scanners, mode and branch, and says which were skipped and why. Starting scans is for operators and team admins.
The other tabs
| Tab | What it shows |
|---|---|
| Findings | Open findings over twelve weeks; their age by severity (0–7, 8–30, 31–90 and over 90 days); findings past or near their due date; the top vulnerability classes; counts by status; reopened and reachable findings, and findings whose status in the issue tracker disagrees with ScanSuite; and the mean time to fix per severity. Open in Vulnerabilities opens the full list. |
| Scans & schedules | Scans per week with failures, scans and failures in the last 30 days, scans running now, the median duration, the product's schedules and monitors (Manage opens Schedules), and its latest scans with their reports. |
| Assets & secrets | Assets in use, new, not yet assessed, not seen for 30 days or rated Critical or High, with their technologies; secrets found and verified, by type, the latest with values masked. Open in Assets and Open in Credentials open the full lists. |
| Settings | The product's details, its suppression rules and suppressed names, and deleting it. |
Settings and deleting
Product details
Operators and team admins edit these fields and click Save; for other members they are read-only.
| Field | What it does | Default | When to change it |
|---|---|---|---|
| Product name | The product's name. Read-only here: operators and team admins click Rename the product on the team's Products page under the form; see Rename a product in Products. | – | – |
| Engagement | The DefectDojo engagement, or the local reference of a local product. Read-only. | – | – |
| Owner | A team or a person responsible for the product, up to 200 characters, for example Payments team. | Empty | Set it so the management report names who acts. |
| Business criticality | Not set, Tier 1: customer-facing or regulated, Tier 2: internal, business-critical, or Tier 3: low impact. | Not set | Set it so the management report weighs the product correctly. |
| Last targets | What the web and infrastructure scan forms fetch as their targets for this product. Their scans replace it with what they scanned. | The repository URL given at creation | To prefill the next web or infrastructure scan. |
The owner and tier appear in the management report.
Suppressions
- Suppression rules lists the rules that apply to the product, each with how often it matched, its expiry, its reason and whether it is Active or Off. Manage opens Rules. See Custom Rules.
- Suppressed names lists the finding names suppressed for this product, each with how many findings were deleted, how many times it kept a finding out, the reason and Active or Off. Manage opens the suppressions on the Rules page. Suppressing a name is described in Vulnerability Management.
Delete product
Shown to operators and team admins. The card says how many findings, secrets and scan records will go. Type the product's name to enable Delete product.
Deleting deletes every finding, the secrets, the hosts, the scan records with their schedules, and what the product's scans spent on LLM calls; the DefectDojo product too when the product is linked to one. There is no undo.
A product with a running scan is not deleted: stop its running scans first.
Trends
The trend lines come from a count of each product's open findings taken every night. A new installation draws the earlier weeks straight away from the dates its findings were found and resolved.
Last reviewed 2026-10-19