> For the complete documentation index, see [llms.txt](https://docs.snyk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/review-and-fix.md). # Review and fix How to review and fix findings from Snyk API & Web scans {% hint style="info" %} **Snyk is rolling out a new navigation.** The steps on this page describe the classic interface. If your view looks different, visit [Navigate the Snyk Web UI](https://docs.snyk.io/navigate-the-snyk-web-ui#where-things-moved) to map these options to the new interface. {% endhint %} ## Review and fix After scanning your targets, use Snyk API & Web to review findings, assess their severity, and assign them to team members for remediation. The review and fix workflow helps you prioritize and manage vulnerabilities efficiently. ### Key features Snyk provides several capabilities to help you manage findings: * **Severity classification**: Understand the risk level of each finding based on exploitability and impact. * **Self-review**: Review and approve or reject low-confidence findings without waiting for manual verification. * **Findings assignment**: Delegate vulnerabilities to specific team members for resolution. * **SAST/DAST correlation**: Link dynamic scan findings directly to vulnerable code locations in your source code. * **Login verification**: Confirm successful authentication during scans to ensure comprehensive coverage. * **Coverage visibility**: See which URLs Snyk tested, why it skipped others, and the recorded request and response. ### Review workflows #### Review scan results After running a scan, you can view detailed results showing scan progress, discovered vulnerabilities, and generated reports. The scan results page provides insights into the scanner components (fingerprinter, crawler, and scanner), HTTP response codes, and the overall risk assessment of your target. Visit the [Interpret target scan results](/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/review-and-fix/interpret-target-scan-results.md) to learn how to understand and analyze scan results. For information about HTTP response codes, visit [HTTP status codes in target scans](/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/review-and-fix/http-status-codes-in-target-scans.md). #### Review coverage results After you start a scan, you can view its coverage to help you answer two important questions: * Was this URL tested? * If not, why not? Visit [Interpret coverage results](/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/review-and-fix/interpret-coverage-results.md) to learn how. #### Review the severity of findings Each finding includes a severity level (Critical, High, Medium, Low) to help you prioritize remediation efforts. The severity considers the likelihood of exploitation, required skills to exploit, and potential impact. Visit [Severity levels in findings](/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/review-and-fix/severity-levels-in-findings.md) for detailed information about how Snyk assigns severity levels. #### Review pending findings Snyk lets you review findings in a **Pending Review** state without waiting for manual verification by the Snyk team. This feature gives you immediate access to low-confidence findings so you can speed up your security reviews. #### Assign vulnerabilities to team members You can assign findings to team members for tracking and remediation. Assign findings individually or in bulk from the **Target** page, **Scan Results** page, or **Finding Details** page. Visit [Assign vulnerabilities to a team member](/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/review-and-fix/assign-vulnerabilities-to-team-member.md) for instructions on assigning findings. #### Review scan login attempts When authentication is configured on a target, you can verify that the scanner successfully logged in by watching a video recording of the login attempt. This helps you confirm authentication worked as expected and alerts you to update target settings if needed. Visit [Review scan login attempts](/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/review-and-fix/review-scan-login-attempts.md) for details on accessing and using login attempt recordings. ### SAST/DAST integration The SAST/DAST integration connects dynamic scan findings from Snyk with static analysis results from Snyk Code. This correlation links DAST findings directly to the vulnerable location in your source code, helping developers fix vulnerabilities faster. When a DAST finding correlates with SAST results, you see: * A SAST label on the finding. * Direct links to the vulnerability in Snyk Code. * Links to the affected repository. * Code snippets showing the vulnerable code. #### Prerequisites * Active accounts in both Snyk API & Web and the Snyk platform. * A target application scanned by both Snyk Code (SAST) and Snyk API & Web (DAST). #### Set up the integration To connect your dynamic and static scan results, follow these steps. **Connect your Snyk accounts** 1. In Snyk, navigate to **Settings** > **Integrations**. 2. Locate the **Snyk** module. 3. Follow the link to the **Snyk group** to start the authentication and authorization process. **Map a target to your Snyk projects** 1. Navigate to the **Targets** page and identify the target you want to integrate. 2. Navigate to the target **Settings** and click the **Integrations** tab. 3. In the **Snyk** module, click **Select projects** to open a new modal. 4. Map the current target to the corresponding code analysis projects from Snyk and click **Save**. **Run a DAST scan** Run a new scan on the configured target. Snyk now correlates the DAST findings from this scan with the SAST findings from your mapped Snyk projects. **Analyze correlated findings** After the scan completes, correlated findings display with a SAST label. To view details, do the following. 1. From the findings list for your target, click a finding to open its details page. 2. Select the **SAST Findings** tab to see the connection between your DAST and SAST results. A DAST finding provides proof that a vulnerability is exploitable. The integration links that finding to the specific line in your source code and shows: * A link to the vulnerability in Snyk Code. * A link to the repository. * A code snippet triggering the vulnerability. **Provide feedback** You can provide feedback on the accuracy of the correlation to help improve the correlation engine. * In the **SAST Findings** tab, report whether the correlation was a match or a mismatch. * Provide qualitative feedback to help fine-tune the correlation process. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/review-and-fix.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.