Security

Where it lives

Open Security from the Security button in the titlebar workspace switcher (the same row as Coordinator and Benchmark mode), or click Review Security on a Security notification in the notification panel — both land you in Security mode.

Views

Security mode is a single-page client with these views:

View	What it shows
Dashboard	Open-finding summary by severity, per-project status, recent audits, spend this month, and a trend sparkline
New run	Choose which registered projects to audit and a profile: quick checks, deep audit, or history scan
Running	Live progress while an audit is in flight, with a cancel action
Results	The finished audit’s findings, led with the highest-severity one, plus a “what Orbit checked” coverage breakdown
Finding	One finding’s detail: severity, impact, occurrences, history, and available actions
Fix preview	The exact scoped diff Security proposes for one finding, and its approval gate
Plan	A fix plan’s phased steps, each with its own preview/approve/verify controls
Trends	Unresolved-finding history across baselines, median dwell time, regressions, and cross-project repeat patterns
Manage	Past audits, saved fix plans, schedules, and the weekly-schedule toggle
Set aside	Findings marked not-a-problem, accepted risk, or deferred, with a restore action
Checklist	The OWASP ASVS reviewer checklist for one completed baseline and project
Export	The plan’s portable Markdown report, ready to copy or download

A clean run (no unresolved urgent/important findings, no coverage gaps) gets its own confirmation screen instead of an empty results list.

Finding states and actions

A finding’s state is one of open, regressed, verified-resolved, or marked-resolved. From an open finding you can:

Set aside as not a problem, accepted risk, or deferred — requires a written reason; deferred requires a future return date. A not-a-problem decision on a suppression-eligible finding can also enable future-match suppression, scoped to the same project, path, and rule.
Restore a set-aside finding, which also turns off any future-match suppression policy it created.
Disable an active suppression policy directly, without restoring the finding it came from.
Mark fixed, which flags the finding as pending an independent re-scan rather than immediately resolving it.
Verify — starts a targeted audit scoped to the finding’s original comparison record to confirm the condition is actually gone.
Confirm credential rotation — for secret findings, records that the credential was revoked or rotated with its provider, independent of the code-level fix.
Preview a fix — builds a source-bound fix preview (a previewHash) with no side effects yet.
Approve a fix — approves exactly one preview by its unchanged hash; a stale preview or drifted source fails the approval instead of applying it.

MCP tools

All Security MCP tools are prefixed orbit_security_*, operator-only (project agents and read-only sessions cannot call them), and require a registered project. Reads and writes are split as follows.

Read-only

orbit_security_readiness — whether deterministic audits and Deep review are ready
orbit_security_dashboard — the dashboard payload: projects, severity summary, recent audits, plans, schedules, and a bounded finding list
orbit_security_notifications — durable Security notifications after a sequence number
orbit_security_checklist — ASVS checklist controls and assessments for one baseline/project/level
orbit_security_audit_results — one audit’s status, per-project results, coverage gaps, and findings
orbit_security_finding — one finding with occurrences, lifecycle history, triage, and ASVS references
orbit_security_plan — one fix plan or campaign with projected step states
orbit_security_trends — trend series, unresolved counts, median dwell, regressions, and fleet repeats
orbit_security_schedules — weekly schedules and their comparison scopes

Actions (mutations)

orbit_security_audit_start / orbit_security_audit_cancel — start or cancel an audit (only one runs at a time; cancellation is never recorded as clean)
orbit_security_checklist_record — record one ASVS assessment, guarded by optimistic concurrency (expected_version)
orbit_security_finding_triage / orbit_security_finding_restore / orbit_security_suppression_disable — set aside, restore, or disable a suppression
orbit_security_finding_mark_fixed / orbit_security_finding_confirm_rotation / orbit_security_finding_verify
orbit_security_fix_preview / orbit_security_fix_approve — build and approve one fix preview (individual approval only)
orbit_security_plan_create / orbit_security_plan_start / orbit_security_plan_pause / orbit_security_plan_export
orbit_security_plan_step_preview / orbit_security_plan_step_approve / orbit_security_plan_step_verify / orbit_security_plan_step_confirm_rotation — per-step campaign actions, each individually approved
orbit_security_schedule_create / orbit_security_schedule_set_enabled — a recurring Deep schedule is refused; only deterministic profiles can be scheduled

Two read-shaped tools are classified as writes because they have side effects: orbit_security_fix refreshes the fix’s stored status from the queue authority when read, and orbit_security_plan_step does the same for a campaign step’s bound fix. orbit_security_plan_export may also materialize review-only fix previews for unbound steps, though it never approves or queues anything.