Hiding false positives, revoked credentials, etc.

Sometimes, Security for Jira will find false positives, credentials which have already been revoked, etc. If this happens, you can review the finding. This marks the finding—as well as any other findings which exactly match it—as reviewed in current and future scans.

Project administrators and Jira administrators can review findings from a project’s Security Analysis page. Reviewed findings are scoped to the project the finding is in.

Click the Mark reviewed button on the finding you want to review, which will open a confirmation dialog:

Marking a finding as reviewed saves the exact string captured by the rule (in this case, aws: N80MLFFfJ2nhNH2aAeld3OJYuF9qs6j4uHR+Y130). That exact string will be marked as reviewed for all existing and future scans in this project.

After the finding is marked as reviewed, all other findings of that exact string will disappear from the Security Analysis.

Reviewed findings can be shown again with the Show reviewed toggle, where they can also be unmarked:

Note that reviewed findings are scoped to a project. Identical findings across multiple projects must be reviewed separately.