`cybros findings`

List findings, and inspect a single finding's full security-workspace detail.

Synopsis

cybros findings [OPTIONS]              # list
cybros findings show FINDING_ID        # detail

Running cybros findings with no subcommand lists findings. Use cybros findings show <id> for the deep detail view.

`cybros findings` — list

Options

Flag	Default	Description
`--scan`	—	Filter by scan id.
`--severity`	—	Filter by severity: `critical`/`high`/`medium`/`low`/`info`.
`--status`	—	Filter by status (e.g. `open`).
`--limit`	`20`	Max findings to return.

Plus the global flags: --json, --api-url, --no-color.

Examples

cybros findings --severity high

                       Findings (3)
┏━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━┳━━━━━━━━━━━━━━┳━━━━━━━━━━┓
┃ Severity ┃ Title               ┃ Status ┃ Location     ┃ ID       ┃
┡━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━╇━━━━━━━━━━━━━━╇━━━━━━━━━━┩
│ high     │ SQL injection       │ open   │ app/db.py:88 │ fnd_1a2b…│
└──────────┴─────────────────────┴────────┴──────────────┴──────────┘

Scope to a scan, or emit JSON:

cybros findings --scan scan_8a1b... --severity critical
cybros --json findings --severity high | jq -r '.[].title'

--severity is applied server-side; --status is filtered client-side after the page is fetched.

`cybros findings show` — detail

Arguments

Argument	Description
`FINDING_ID`	The finding id to inspect.

Example

cybros findings show fnd_1a2b...

╭─ Finding fnd_1a2b… ──────────────────────────╮
│ high  SQL injection                           │
│ Rule: py.sql-injection   Status: open         │
│ Location: app/db.py:88                        │
│ OWASP A03   CWE 89   CVSS 8.6                  │
│                                               │
│ User input is concatenated into a raw SQL     │
│ query without parameterization.               │
╰───────────────────────────────────────────────╯
╭─ Evidence ───────────────────────────────────╮
│  87   def get_user(uid):                      │
│  88 ▸     q = "SELECT * FROM users WHERE id="+uid │
╰───────────────────────────────────────────────╯
╭─ AI explanation ─────────────────────────────╮
│ An attacker can inject SQL via `uid`…         │
╰───────────────────────────────────────────────╯
╭─ Suggested patch ────────────────────────────╮
│ - q = "SELECT * FROM users WHERE id=" + uid   │
│ + q = "SELECT * FROM users WHERE id = %s"     │
╰───────────────────────────────────────────────╯

The detail view renders whatever is available: the evidence snippet (syntax highlighted), OWASP/CWE/CVSS tags, the AI explanation, the remediation text, and a unified-diff patch. Get it as structured data with --json:

cybros --json findings show fnd_1a2b... | jq '.fix.unified_diff'

Exit codes

Code	When
`0`	Findings listed / shown.
`1`	Unknown finding or API error.
`2`	Not authenticated.

cybros findings