FAQ & Troubleshooting

Common questions and fixes. If you don't find it here, try the search box or the in-app AI Assistant.

Scanning

A DAST scan finished but found almost nothing - is my app really clean? Check the Coverage panel on the scan results. Low coverage usually means authentication wasn't working or the scope was too narrow. Configure authenticated scanning, widen scope, and re-scan.

My scan is stuck or very slow. Open the scan's activity log to see what stage it's in. Deep scans take 1-2 hours. If nothing is progressing, check the Health Monitor for scanner/queue status.

The scan can't log in to my app. Your logged-in indicator is probably wrong, so the engine thinks the session failed. Re-check the auth config and use Test login - see Authenticated scanning.

Findings & triage

Why do I see one vulnerability when two tools found the issue? That's by design - apPosture deduplicates across tools into one vulnerability carrying both sources' evidence.

How do I stop a false positive from coming back? Mark it False positive in the Vulnerabilities hub; it's suppressed via a mute rule on future scans.

What does "Exploit confirmed" mean exactly? apPosture produced a working proof-of-exploit - it's proven, not an AI guess. These should be your top priority.

Code scanning

"Repository not found" when scanning. apPosture clones source on demand. Ensure the repo is connected via Integrations and the token has access.

SCA shows a Critical CVE but it's in a dependency we don't use. Check the reachability verdict on the SCA finding - unreachable CVEs are lower real risk and the Priorities funnel deprioritises them.

CI/CD

My pipeline gate fails constantly. Start in report-only mode and tighten gradually, and scope the policy to block only on Critical + KEV first.

Where do I get the CI token? Create an apt_ token under Account Security. It's shown once - copy it immediately.

Access & display

Why are timestamps not in my timezone? All times display in GMT+4 (Asia/Baku); they're stored in UTC and converted.

I can't see the Administration menu. It's visible to Admin users only. Ask an administrator to grant the role via Identity & Access.