DefectDojo
DefectDojo is our vulnerability management platform. It aggregates security findings from automated scanners (Trivy, Semgrep) and tracks remediation.
Accessing DefectDojo
- Open defectdojo.shared.cwiq.io (requires Tailscale)
- Sign in via SSO
Key Concepts
| Concept |
Description |
| Product |
A software component being scanned (maps to a repository) |
| Engagement |
A testing activity (e.g., a CI/CD pipeline scan) |
| Finding |
A single vulnerability or security issue |
| Severity |
Critical, High, Medium, Low, Informational |
Products
Each CWIQ repository has a corresponding DefectDojo product:
| Product |
Repository |
Scanner |
orchestrator-server |
Backend API |
Trivy (filesystem + Docker image) |
orchestrator-ui |
Frontend |
Trivy (filesystem + Docker image) |
orchestrator-agent |
Task agent |
Trivy (filesystem + Docker image) |
orchestrator-mcp |
MCP server |
Trivy (filesystem + Docker image) |
orchestrator-cli |
CLI tool |
Trivy (filesystem) |
orchestrator-executor |
Sandbox executor |
Trivy (filesystem) |
Navigating Findings
- Click Findings in the sidebar
- Filter by:
- Severity: Critical, High, Medium, Low
- Status: Active, Verified, Mitigated, False Positive
- Product: Select a specific repository
- Click a finding to see details: description, affected component, remediation guidance
Understanding Severity
| Severity |
Action Required |
| Critical |
Fix immediately — blocks deployment |
| High |
Fix before next release |
| Medium |
Fix in this release cycle |
| Low |
Track for future remediation |
CI/CD Integration
Trivy scans run automatically in every pipeline and upload results to DefectDojo. See Trivy + DefectDojo in CI/CD for details.