FAQ
Use these answers when scan results, priorities or delivery do not match what you expected.
Last verified on October 30, 2026.
Why are results dated, stale, or shown as —?
Section titled “Why are results dated, stale, or shown as —?”Perpensa displays stored analysis results. A queued or running scan is not a completed result, and a failed attempt can leave older results available during a grace period. On Overview at /app/overview, Stale means the scan timestamp used for the score is more than seven days old. A missing timestamp does not trigger that badge.
— means a count cannot be verified, rather than zero. Overview explains: Not verified: some Production sources were not fully scanned or have no advisory coverage. In Repositories at /app/repos, dimmed counts are historical. Check the source status and result date before relying on them. See Overview and Repositories.
Does zero findings mean my software is safe?
Section titled “Does zero findings mean my software is safe?”No. No known vulnerabilities were found for the scanned versions. describes the checked versions and available advisory evidence. A public repository pin can have zero findings because no known CVEs are indexed for it. Missing coverage cannot establish a clean result.
Docker base-image checks cover end-of-life and pinning, with no image CVE scan. Check coverage alongside counts; see Understand results and Coverage.
What does advisory-data freshness mean?
Section titled “What does advisory-data freshness mean?”A recent scan can use advisory data fetched earlier. If OSV cannot be reached, earlier advisory data can be used instead. When that data is considered archived, the scan disclosure says OSV could not be reached. These results are based on archived OSV vulnerability data (code: osv_archived). The scan date alone therefore does not establish that advisory data was fetched at that time.
Other diagnostics distinguish incomplete checks, including Some package versions could not be checked. Results are incomplete and previous findings are retained (code: osv_full_query_failed). See Coverage.
Why is my repository not scanned?
Section titled “Why is my repository not scanned?”Connecting a repository alone does not attach it to an application. Configure the exact branch or tag in Applications at /app/applications. A repository outside applications shows Not used by any application and Not scanned, nothing counted.
Lost access, a failed attempt, a moved tag, or plan restrictions can also prevent fresh results. The tag changed commit requires review of the newly observed commit. Members and administrators can perform source actions; viewers cannot. See Repositories and Manage applications.
Why does a finding still appear after I updated the dependency?
Section titled “Why does a finding still appear after I updated the dependency?”Updating your code does not replace the stored scan result. Scan the branch or tag configured for the affected application and environment, then check that the new analysis completed. A pinned tag still identifies that tag, rather than another branch where you made a fix.
Only complete coverage can confirm that a finding disappeared. An incomplete check retains previous findings instead of treating unchecked packages as fixed. See Findings and Remediate and verify a fix.
Does Perpensa open pull requests or change my code?
Section titled “Does Perpensa open pull requests or change my code?”No. Perpensa never opens pull requests, pushes commits or applies dependency version bumps. Copy prompt or Copy prompt for your coding agent copies instructions for your own development workflow. Copying does not execute the change.
If copying fails, the prompt can be selected manually. Make and review the change yourself, then rescan the configured source to verify the result. See Update queue and Remediate and verify a fix.
What does Accept risk do, and how do I undo it?
Section titled “What does Accept risk do, and how do I undo it?”Accept risk records a decision for the finding in the selected application environment. It is logged and excludes the accepted context from open results; other open contexts remain open. It does not technically resolve the vulnerability or change its priority category to Monitor.
In Findings at /app/findings, select Accepted risks, locate the context and use Restore to reverse the decision. Members and administrators can accept and restore risks; viewers cannot. See Findings and Update queue.
How does Perpensa Rank relate to severity?
Section titled “How does Perpensa Rank relate to severity?”Severity and priority order are separate information. Rules set the Fix now, Plan or Monitor category. On Pro and Team, Perpensa Rank refines the order within that category. Starter uses rules. A ranking badge does not mean the advisory severity changed.
When review keeps the order, is still processing or is unavailable, Rules can explain the current ordering. See Overview, Findings and Update queue.
Who can do what?
Section titled “Who can do what?”Access is checked against your membership in the organization.
| Role | Relevant permissions |
|---|---|
| Viewer | Read organization results and generate result exports. Cannot perform scan, repository or risk-decision actions. |
| Member | Viewer access, plus repository and scan actions, accepting or restoring risk, and generating digests. |
| Administrator | Member access, plus managing organization members, policies and notification connections. |
Permissions do not bypass plan limits. See Settings, Repositories, Digests and Exports.
Which plan limits can affect me?
Section titled “Which plan limits can affect me?”| Allowance | Starter | Pro | Team |
|---|---|---|---|
| Tracked branches | 5 | 75 | 300 |
| People | 1 | 10 | Unlimited |
| Active API and MCP accesses | 0 | 5 | 25 |
| Perpensa Rank | Not included | Included | Included |
| Email digests | Included | Included | Included |
| Slack digests | Not included | Included | Included |
| Custom scan and digest schedules | Not included | Included | Included |
Starter allows one manual organization-wide Scan all per rolling 24 hours. Tracked-branch allowances apply across the organization. At the tracked-branch limit, remove a reference in Applications or upgrade through Billing; Team can also contact support. See Settings and Manage applications.
How do I export an SBOM?
Section titled “How do I export an SBOM?”Open Exports at /app/exports. Under Dependency inventory, choose CycloneDX 1.5 JSON or SPDX 2.3 JSON and select Generate export. The generated file downloads; Download lets you retrieve a ready artifact again during the session.
Exports use stored Production application-source results and do not run a scan. All organization roles can generate them, with no paid-plan requirement; requests are limited to 20 per organization per minute. Export failed. Try again. indicates failure. Recent exports (this session) clears when you leave or reload the page; downloaded files remain on your device. See Exports.
Why was my digest not delivered?
Section titled “Why was my digest not delivered?”A stored digest is not necessarily a delivered message. In Digests at /app/digests, Preview email only saves a preview and never sends email; its notification reads Email digest stored (not delivered) with the reason. Generate Slack attempts delivery: the notification reads Slack digest delivered on success, or Slack digest stored (not delivered) followed by the reason. Digest history does not show that reason afterwards. Scheduled email delivery follows each member’s preferences in Settings → Notifications.
| Reason in the notification | What to check |
|---|---|
| No open updates in the queue — nothing to send | The update queue has no open updates. |
| No open updates meet the org digest severity floor | The organization digest severity floor in Settings → Policies. |
| Some sources were not fully scanned or lack coverage | Rescan or fix the sources before relying on an empty digest. |
| This is an email preview. | Scheduled email delivery follows preferences in Settings → Notifications. |
| Set a Slack webhook in Settings → Notifications | Configure the Slack connection. Slack digests require Pro or Team. |
| Email delivery is unavailable right now. | Contact support with the displayed code. |
The scheduled Slack job saves digests without posting them; use Generate Slack in Digests to send one. See Digests, Settings and Email notifications.
How do I sign in or recover organization access?
Section titled “How do I sign in or recover organization access?”At /login, select Continue with GitHub when available. If Could not load sign-in options. Try again. appears, retry. Sign-in is unavailable right now. Contact support (code: AUTH_DISABLED). requires support.
Signing in and organization membership are separate checks: matching an email address alone does not grant organization access. Ask an administrator to check your membership or issue an invitation, then accept the invitation while signed in. See Your first scan and Settings.
Which Perpensa version does this documentation describe?
Section titled “Which Perpensa version does this documentation describe?”This site has a single version, published with each Perpensa release, and it does not keep pages for older versions. Reference pages that show a Last verified date were last checked on that date. The in-app Documentation link always opens this site.
For term definitions, see the glossary.