Skip to main content

​
The Review Workspace

Triaging Findings This is where the work happens. The Review Workspace is built so a reviewer can go through a backlog quickly without losing the evidence trail. It’s arranged into three panels: what to review, the evidence, and the record.

​
Three Ways to Work

The toggle at the top switches how the backlog is organised. Use Components to clear volume, and drop to Files when you need to see a match in context.

​
Reading the Evidence

The middle panel shows the actual matched source with the match percentage, 100% for a whole-file match, lower for a snippet. The right-hand panel identifies the component (name, vendor, package identifier) with its licence, known vulnerabilities, and how far behind the current release it is.

​
Cryptographic Findings

A cryptographic finding highlights the exact lines where the algorithm is used, in the same source panel, there’s no separate view to learn. A finding in your own code shows No package — first-party code; one inside a dependency names that package instead. The right-hand panel adds a reachability pill and one line explaining it:
  • Reachable means Earnie traced a call path from an entry point to that code.
  • Not reached means it looked and found none.
  • Unknown means the analysis couldn’t decide.
When there’s a path, View call trace opens it, entry point first, each step naming the function, its file, and its line. When the finding sits inside a dependency, its code lives in that package’s own source, which isn’t among your scanned files. Earnie shows the real file anyway when it resolved that package’s source during the scan, today Java projects built with Maven or Gradle, opened at the line where the algorithm is used, in the same source panel as your own code. Otherwise the panel shows the single matched line instead of the whole file, captioned with the line number and the package it came from. If even that is unavailable it says Code not available, rather than showing what looks like an empty file. The decision controls stay available in every case.
Not reached is not the same as not used. The trace is static analysis. It can’t follow code reached through reflection, dynamic dispatch, or configuration, and some languages have no call-graph support at all, which is why Earnie says Unknown rather than guessing. Treat a reachable finding as more urgent; never treat an unreachable one as harmless.

​
Making a Decision

Use Decide, and pick the answer that’s true: For a declared dependency the pair is Accept into SBOM or Dismiss. Earnie moves you to the next open finding automatically after each decision, and every decision offers Undo. A cryptographic finding has its own three decisions: All three close the finding and keep its row, so an accepted risk stays visible instead of quietly disappearing. Whether the algorithm is reachable changes what you decide, never which decisions you’re offered.
There is no “Fixed” for cryptography. You record a fix by removing the weak algorithm and re-scanning. The next run reports it as gone and keeps your decision history, a claim Earnie can verify, rather than one it has to take your word for.
Decide a whole component at once. From Components mode, the Decide menu applies to every open file for that component, Shift+1 to confirm all, Shift+2 to mark all original. This is the single biggest time-saver on a large first triage.
Teach Earnie once. When you replace a component, you can also save it to the project’s Scan Configuration. Future scans apply the same correction on their own, instead of asking you again.
Every action is written to the finding’s Audit Trail: what was decided, by whom, when, and what the state was before. That record is what makes the decision defensible later.

​
Keyboard Shortcuts

Triage is the one screen worth learning the keys for. Press ? anywhere in the Review Workspace for the live list.
Shortcuts are inert while you’re typing in a field, and the decision keys only appear for roles that can record decisions.

​
Finding States

In the workspace these collapse to three practical buckets: pending (needs you), identified (decided), and original (your own code).

​
What’s Next

With findings triaged, the next step is turning the judgement calls you keep repeating into a policy that applies itself.