Risk & Compliance
Give security findings a clear path from discovery to review.
A finding becomes useful when teams can understand it, decide what to do, apply consistent policies, and track the result. Qualipr brings vulnerability management, security review, quality policies, and compliance references into one governance domain.
- Organize and manage security findings.
- Review security items and document decisions.
- Apply consistent quality profiles and gates.
- Understand relationships to relevant security frameworks.
Risk & Compliance / Vulnerability Management
Turn security findings into work your team can prioritize and follow through.
Bring findings into a consistent workspace where teams can understand severity, status, ownership, context, and remediation activity.
Placeholder: the real product screenshot will replace this image Review findings with their severity, status, ownership, and code context in one place.
The problem
Security findings lose value when they remain scattered across reports or lack ownership and follow-up. Teams need a shared way to understand what is open, what has been reviewed, and what needs action.
How it works
Qualipr organizes findings with filtering, issue context, status, ownership, comments, and activity history according to the product’s supported workflow.
What you can do
- Browse and filter findings.
- Review issue context and affected code locations.
- Assign ownership where supported.
- Track issue status and review activity.
- Use available severity, quality, repository, and framework facets.
- Manage findings from every supported scan type in one place.
What you get
A more actionable view of security and quality findings, helping teams move from detection to review and remediation.
Where it fits
Code findings can be reviewed and managed through the platform’s security finding workflows.
Framework references can add context to selected security findings.
Risk & Compliance / Security Review
Give security-sensitive findings a deliberate review, not just a status change.
Review security items with context, ownership, comments, and a clear decision history so teams can record how each item was assessed.
Placeholder: the real product screenshot will replace this image See which security items still need a decision, who owns them, and what was decided.
The problem
Some security findings require human judgment. Teams need to distinguish items that still need review from those that have been acknowledged, assessed as safe, or fixed.
How it works
Security Review provides a workflow for reviewing identified security items, recording decisions, assigning responsibility, and retaining relevant activity.
What you can do
- Review items awaiting assessment.
- Record review decisions.
- Add required context through comments.
- Assign responsibility.
- Track review activity and lifecycle.
What you get
A traceable review process that helps teams understand which security items have been assessed and what decisions were recorded.
Where it fits
Risk & Compliance / Quality Profiles
Give teams a consistent set of rules for evaluating code.
Organize the analysis rules used across repositories so teams can apply consistent expectations while retaining the ability to manage profiles for different needs.
Placeholder: the real product screenshot will replace this image See which rules are active for a language and which repositories use the profile.
The problem
When projects use inconsistent rule configurations, teams can struggle to compare results or maintain a shared standard for code analysis.
How it works
Quality Profiles define the active rules used for analysis by language and repository association. The effective profile determines which rules are applied during analysis.
What you can do
- Create or extend profiles.
- Copy and compare profiles.
- Manage active rules.
- Associate profiles with repositories.
- Set default profiles for supported languages.
- Review profile changes and history.
What you get
A more consistent and manageable rule configuration across the codebases your teams assess.
Where it fits
Profiles determine the rules used in analysis; gates evaluate configured quality conditions against available measures.
Risk & Compliance / Quality Gates
Make quality expectations visible when changes are being evaluated.
Define measurable quality conditions and use Quality Gates to evaluate whether a code change meets the expectations configured for its workflow.
Placeholder: the real product screenshot will replace this image Evaluate code changes against the quality conditions your team has defined.
The problem
Teams need a consistent way to evaluate code changes. Without shared conditions, quality decisions may vary between repositories or depend on manual interpretation.
How it works
Quality Gates evaluate configured conditions against available analysis measures. For supported merge-request workflows, the result communicates whether the evaluated conditions pass or fail. A Quality Gate is a separate policy evaluation from Code Posture, which is an informative branch assessment.
What you can do
- Configure gate conditions.
- Manage named and default gates.
- Associate gates with repositories.
- Review evaluation history.
- Recalculate applicable evaluations when needed.
- Enforce your quality and security standards before changes are released.
What you get
A consistent, visible evaluation of defined quality conditions, helping teams make more informed decisions about code changes.
Where it fits
Profiles determine the rules used in analysis; gates evaluate configured quality conditions against available measures.
Risk & Compliance / Compliance Registry
Connect security findings to the standards your teams need to understand.
Explore structured references between security rules, weaknesses, and relevant security frameworks so teams can understand how technical findings relate to compliance requirements.
Placeholder: the real product screenshot will replace this image See how security rules and weaknesses relate to the framework controls your teams need to understand.
The problem
Security teams often need to explain how technical findings relate to security standards. That relationship is difficult to communicate when rule information and framework references are disconnected.
How it works
The Compliance Registry organizes framework controls and supported mappings to security rules or weakness references, making those relationships available in relevant product views. It provides references and mappings; the compliance outcome depends on the scope and evidence you assess.
What you can do
- Explore supported security frameworks, including OWASP, CWE, ASVS, MASVS, and PCI DSS references.
- Review framework controls.
- Understand verified rule and weakness references.
- Use compliance context in relevant security views.
- Use the mappings as a basis for compliance evidence and reports.
What you get
A more structured way to understand how selected security findings relate to recognized framework references.
Where it fits
Framework references can add context to selected security findings.
FAQ
Questions about this module
What is the difference between a Quality Profile and a Quality Gate?
Profiles determine the rules used in analysis. Gates evaluate configured quality conditions against the available measures.
Does the Compliance Registry guarantee compliance?
No. The registry provides references and mappings between security rules, weaknesses, and frameworks. The compliance outcome depends on the scope and evidence you assess, and Qualipr does not guarantee compliance or confer any formal status.
How does Security Review differ from changing a finding’s status?
Security Review is a workflow for reviewing security items with context, ownership, comments, and a recorded decision history, so each item’s assessment can be traced.
Explore the other modules
- Code Security & Quality Find weaknesses in code before they travel further.
- Supply Chain Security Know what your software is built on.
- Infrastructure Security Catch configuration risks across the environments your software depends on.
- Application Testing Find vulnerabilities in applications while they are running.
- Platform Operations Keep security activity coordinated across teams and software assets.
Make security easier to understand, and easier to act on.
Bring your code, applications, dependencies, infrastructure, and security governance into one connected platform.