Audit evidence
What Railo records for every fix
Which finding, what changed, how the change was checked, and what your team decided. Railo records the work. Your auditor decides what it counts towards.
Per fix
Six facts, every time.
- Finding
- The rule, CWE, severity, file and line that were reported.
- Change
- The exact diff, delivered as a fix pull request or as suggestions. Nothing is committed to your branch.
- Rescan
- Railo's rules run again on the changed files: the finding must be gone and no new finding may appear. For findings imported from another scanner, Railo says that rule was not re-run.
- Structural check
- For the fix classes that have one, the safe construct is confirmed present in the fixed code, such as a bound query parameter.
- Decision
- Whether the fix met the bar to be proposed as is, or needs a person to look closely.
- Outcome
- What your team did with the fix: merged, closed or still open. GitHub records who merged it.
Where you get it
Where your auditor already looks.
In the fix pull request.
Each fix lists its findings with the rescan and check results, next to the diff your reviewers approve.
In GitHub code scanning.
The Action uploads SARIF, so findings and their closure appear in your repository's Security tab, with GitHub's own history.
As a CSV.
One row per finding: the format a Fix Sprint's evidence pack comes in. It holds findings and outcomes, never your source code.
Example record
One exported row, as an illustration, not customer data.
| repository | example-org/api |
|---|---|
| pr_number | 7 |
| rule | python-sqli |
| cwe | CWE-89 |
| file | app/db.py |
| line | 12 |
| fixed | yes |
| recommended_action | review_required |
| verification_outcome | verified |
| fix_pr_url | https://github.com/example-org/api/pull/41 |
| fix_pr_state | merged |
To be plain
What Railo does not do.
- It does not prove your tests pass. It tries your test command before and after each fix, inside the Action's container, and drops a fix that adds a failure; but without your project's dependencies most test commands cannot start there. Your own CI, running on the fix like on any other change, is the real test.
- It does not issue compliance certificates or readiness scores.
- It does not commit to your branches. Every change arrives as a pull request or a suggestion.
An audit or a customer review coming up?
A Fix Sprint fixes your open findings in one week and hands you the evidence pack.