> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/web-application-and-api-protection-waap-protection-protection/discovery/risk/issues-overview.md).

# Issues Overview

<details>

<summary><strong>Updates (October 2026 to December 2026)</strong></summary>

* *October 2026* — Updated the Issues page to include support for AI assets, including MCP tools, prompts, and resources.

</details>

The **Issues** page brings together the security issues that Harness detects across your APIs and AI assets, from vulnerabilities and risky patterns to compliance gaps. Use it to see where your risks are, decide what to fix first, and track each issue through to resolution.

<figure><img src="https://1414883571-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdr7UJpJrdGkkSGT6AFTu%2Fuploads%2F1O68eYTRRTXCeLXJHNFy%2Fdiscovery_issues.png?alt=media&amp;token=fe25acf8-83a7-42d7-8239-dda974672a35" alt=""><figcaption><p>Issues</p></figcaption></figure>

## What you will learn from this topic

By the end of this topic, you will be able to:

* Understand what **Issues** are and how Harness detects and displays them.
* Understand the **Issue life-cycle**, from discovery to remediation and monitoring.
* Identify the issue types that Harness detects for APIs and AI assets.
* Understand the **key components** such as:
  * Visual charts for severity and status trends
  * Issue listings with column-level information
  * Grouping and Filtering options to organize and prioritize issues effectively

If you already have an understanding of these components and want to learn how you can drill down and manage an issue, see [Issue Management](/web-application-and-api-protection-waap-protection-protection/discovery/risk/issue-management.md).

***

## Issues and how Harness identifies them

Issues are security gaps in your assets that threat actors may exploit to attack your infrastructure. An asset is a discoverable entity that Harness monitors for security issues. Supported assets include APIs, AI APIs, and  MCP assets (MCP tools, prompts, and resources). The issue types that Harness detects depend on the asset type. For more information, see [Issue types](#issue-types).\
\
Harness identifies assets and services in your environment through the [discovery process](/web-application-and-api-protection-waap-protection-protection/discovery/risk/issues-overview.md). After Harness discovers the assets, it scans them and their associated services for issues and displays them on the **Issues** page.

{% hint style="info" %}
Harness does not scan APIs for issues during the learning phase.
{% endhint %}

***

## Benefits of the Issues page

The Issues page offers a streamlined and intuitive experience to help you identify issues, understand them in depth, conduct a risk assessment, and resolve them efficiently. Even after you resolve an issue, Harness continuously monitors the assets that you have remediated and secured. It reports an issue if it finds any in the future; therefore, continuous monitoring is necessary. For more information, see [Journey of an Issue](#journey-of-an-issue).

***

## Journey of an Issue

Every security story in Harness begins with an asset and is mapped through an issue lifecycle. The issue-management lifecycle process helps identify and remediate security risks before threat actors can exploit them.

<div align="center"><figure><img src="https://1414883571-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdr7UJpJrdGkkSGT6AFTu%2Fuploads%2FcrBiBJjpH15RW4I3EWqZ%2Fissue_management_lifecycle_identify_assets.png?alt=media&amp;token=75ccd61a-3e75-481e-b732-792ba09accfe" alt="" width="375"><figcaption><p>Issue Management Life Cycle</p></figcaption></figure></div>

The following is the lifecycle and how issues flow within it:

| Stage                                        | Description                                                                                                     |
| -------------------------------------------- | --------------------------------------------------------------------------------------------------------------- |
| **Discovery** (Identify Assets)              | Asset Identification via live traffic or integrations.                                                          |
| **Scan** (Issue Scan)                        | Scans your identified assets to detect potential vulnerabilities.                                               |
| **Analysis** (Risk Assessment)               | You analyze the issue, including what it is, where it occurred, and the associated risks.                       |
| **Remediation**                              | You act on the issue: fix it, mark it under review, accept the risk, or dismiss it.                             |
| **Monitoring** (Verification and Monitoring) | Harness verifies the remediation on the affected assets, tracks its reoccurrence, and reopens it, if necessary. |

This feedback loop ensures that you are always working with relevant, current, and actionable security information and issues.

***

## Understanding Issues

The **Issues** page is a centralized hub for visualizing all vulnerabilities detected in both **External** and **Internal assets**. It provides a comprehensive overview of open issues, including their severity and key details such as the last time they were seen. This dashboard provides a clear snapshot of your system’s security risks, helping you investigate and prioritize their resolution efficiently. To view the Issues page, navigate to **Discovery** → **Risk** → **Issues**.

For information on how to drill down into an issue, manage its status, and remediate it, as well as the rules surrounding resolution and deletion, see [Issue Management](/web-application-and-api-protection-waap-protection-protection/discovery/risk/issue-management.md).

### Issue types

Harness detects different types of issues based on continuous learning. The issue types vary by asset type:

{% tabs %}
{% tab title="API" %}
The following table lists the issue types that Harness detects for API endpoints:

| Category                    | Issue Type                                                                                                                                                                                                                     |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Insecure Design             | <ul><li>Query params contain sensitive data</li><li>Lack of encryption</li><li>API params contain URL</li><li>HTTP redirect</li><li>Insecure HTTP method</li><li>Username and password enumeration</li><li>Regex DOS</li></ul> |
| Remote Code Execution       | <ul><li>Java Log4Shell</li><li>Buffer overflow</li><li>Integer overflow error</li></ul>                                                                                                                                        |
| Security Headers            | <ul><li>HSTS header misconfiguration</li><li>Missing nosniff in content type options header</li><li>CSP header misconfiguration</li></ul>                                                                                      |
| Authentication              | <ul><li>Basic authentication method</li><li>Unauthenticated access</li><li>Weak password</li></ul>                                                                                                                             |
| SQL Injection               | <ul><li>Blind SQL injection</li><li>Error-based SQL injection</li></ul>                                                                                                                                                        |
| Data Exposure               | <ul><li>Excessive data exposure</li></ul>                                                                                                                                                                                      |
| JSON Web Token (JWT)        | <ul><li>JWT token expiry</li><li>JWT weak algorithm</li><li>JWT algorithm confusion</li><li>JWT invalid signature</li><li>JWT JKU misuse</li><li>JWT missing audience claim</li></ul>                                          |
| Improper asset management   | <ul><li>Multiple versions of the API</li></ul>                                                                                                                                                                                 |
| Business logic              | <ul><li>Parameter pollution</li><li>Mass assignment</li></ul>                                                                                                                                                                  |
| Security misconfiguration   | <ul><li>HTTP-only site</li><li>Server version disclosure</li><li><code>.env</code> information leak</li><li>HTTPS not accessible</li><li>Directory listing leak</li></ul>                                                      |
| Access control              | <ul><li>Rate limiting</li></ul>                                                                                                                                                                                                |
| TLS                         | <ul><li>TLS not implemented</li><li>TLS/DTLS CBC attack (Lucky13)(CVE-2013-0169)</li><li>Self-signed certificate</li></ul>                                                                                                     |
| Authorization               | <ul><li>Broken object-level authorization</li><li>Broken function-level authorization</li></ul>                                                                                                                                |
| Cross-site scripting        | <ul><li>Reflected cross-site scripting</li></ul>                                                                                                                                                                               |
| Server-side request forgery | <ul><li>Server-side request forgery blind</li></ul>                                                                                                                                                                            |
| Conformance                 | <ul><li>Mismatching authentication type</li><li>Mismatching parameter types</li><li>Mismatching request content type</li><li>Mismatching response content type</li><li>Missing parameters</li><li>Shadow parameters</li></ul>  |
| {% endtab %}                |                                                                                                                                                                                                                                |

{% tab title="MCP tool" %}
The following table lists the issue types that Harness detects for MCP tools:

| Category                  | Issue Type                                                                                                                                                                   |
| ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Insecure Design           | <ul><li>Unencrypted external MCP tool</li><li>MCP tool lacks encryption</li><li>HTTP redirect in MCP tool</li></ul>                                                          |
| Authentication            | <ul><li>Unauthenticated external MCP tool</li><li>Basic authentication used for MCP tool</li></ul>                                                                           |
| Data Exposure             | <ul><li>Unauthenticated MCP tool exposing sensitive data</li><li>Sensitive data exposure in external MCP tool</li><li>Excessive data exposure in MCP tool response</li></ul> |
| JSON Web Token (JWT)      | <ul><li>JWT token expiry for MCP tool</li><li>JWT weak algorithm for MCP tool</li><li>JWT missing audience claim for MCP tool</li></ul>                                      |
| OAuth                     | <ul><li>OAuth anti-CSRF check in MCP tool</li><li>OAuth implicit grant type for MCP tool</li></ul>                                                                           |
| Improper asset management | <ul><li>MCP tools exposed to the public internet</li></ul>                                                                                                                   |
| Security misconfiguration | <ul><li>Server version disclosure in MCP tool</li><li>Directory listing leak in MCP tool</li></ul>                                                                           |
| Conformance               | <ul><li>MCP tool shadow parameters</li><li>MCP tool orphan parameters</li><li>MCP tool parameter type mismatch</li></ul>                                                     |
| {% endtab %}              |                                                                                                                                                                              |

{% tab title="MCP resource" %}
The following table lists the issue types that Harness detects for MCP resources:

| Category                  | Issue Type                                                                                                                                                                              |
| ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Insecure Design           | <ul><li>Unencrypted external MCP resource</li><li>MCP resource without encryption</li></ul>                                                                                             |
| Authentication            | <ul><li>Unauthenticated external MCP resource</li><li>MCP resource without authentication</li></ul>                                                                                     |
| Data Exposure             | <ul><li>Unauthenticated MCP resource exposing sensitive data</li><li>Sensitive data exposure in external MCP resource</li><li>Sensitive data leakage in MCP resource response</li></ul> |
| Improper asset management | <ul><li>Publicly exposed MCP resource</li></ul>                                                                                                                                         |
| Conformance               | <ul><li>MCP resource content type mismatch</li></ul>                                                                                                                                    |
| {% endtab %}              |                                                                                                                                                                                         |

{% tab title="MCP prompt" %}
The following table lists the issue types that Harness detects for MCP prompts:

| Category                  | Issue Type                                                                          |
| ------------------------- | ----------------------------------------------------------------------------------- |
| Data Exposure             | <ul><li>Hardcoded secrets in prompt template</li></ul>                              |
| Improper asset management | <ul><li>Publicly exposed MCP prompt</li></ul>                                       |
| Conformance               | <ul><li>MCP prompt shadow parameters</li><li>MCP prompt orphan parameters</li></ul> |
| {% endtab %}              |                                                                                     |
| {% endtabs %}             |                                                                                     |

Harness raises the issue types in the Conformance category through conformance analysis, by comparing the uploaded MCP Server documentation with live traffic. For more information, see [Conformance Analysis](/web-application-and-api-protection-waap-protection-protection/discovery/risk/conformance-analysis.md).

### Issue sources

The Issues page displays issues discovered during runtime protection, API security testing (AST), conformance analysis, or detected by an Issue policy. These issues come from the following sources:

* Live Traffic
* AST
* Compliance
* Conformance Analysis

### Issue severity

Harness categorizes detected issues based on their criticality and impact on your application ecosystem. The following are the categories in descending order of severity:

* **Critical** — Represents issues that pose the highest risk and require immediate remediation to prevent significant security breaches.
* **High** — Represents issues that may expose sensitive data or compromise system integrity if not addressed promptly.
* **Medium** — Represents moderate risks that may not be immediately exploitable but can still weaken security over time.
* **Low** — Represents minor issues with limited impact, and are often resolved during routine maintenance.
* **Informational** — Represents issues that do not pose a security risk, but provide context, such as configuration details, exposed metadata, and usage patterns.

### Key components

The page contains key components that help you quickly assess and understand issues. Below are the main elements of the page and their significance:

<figure><img src="https://1414883571-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdr7UJpJrdGkkSGT6AFTu%2Fuploads%2FIrdyhtOk3Cn16xDDMLzV%2Fdiscovery%20_issues_key_components.png?alt=media&amp;token=24af1720-edcd-4c0a-82f3-a7fd2d382597" alt="Issues Overview"><figcaption><p>Issues Key Components</p></figcaption></figure>

#### Visual insights

At the top of the page, Harness shows the following charts:

| Chart                  | Description                                                                                                                              |
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| **Issues by Severity** | Shows the count of issues by severity (Severity Breakdown). You can click on the severity to filter the results based on your selection. |
| **Issues by Status**   | Shows a trend of the open and resolved issues over the past 30 days.                                                                     |

Collectively, the above charts provide an overview of your application’s security health and trends, based on which you can take the necessary actions.

#### **Issue listings**

Each entry on the page represents a unique issue, when grouped by **Issue Name** (default), with each column providing the following details. If you wish to drill down into an issue and manage it individually according to your requirements, see [Navigating the Issues Flow](/web-application-and-api-protection-waap-protection-protection/discovery/risk/issue-management.md#navigate-the-issues-flow).

| Column                   | Description                                                                                                                                                                                                                                                                                                                                                                          |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Issue Name**           | Specifies the issue's name, such as *Broken Object Level Authorization*. This name is used across the Harness platform for identification purposes.                                                                                                                                                                                                                                  |
| **Severity**             | Each issue is categorized by color-coded labels (*Low*, *Medium*, *High*, *Critical*), enabling you to quickly assess its impact and urgency. This is helpful as it provides a way to prioritize issue resolution based on risk, focusing on high-severity issues that may require immediate attention, while lower-severity issues can be addressed as part of routine maintenance. |
| **Issues**               | Specifies the number of instances of the issue that Harness detected across your assets. This helps you understand how widespread the issue is.                                                                                                                                                                                                                                      |
| **Framework References** | Specifies the security framework risks that the issue maps to, such as *OWASP API 2023:API2*, *OWASP LLM 2025:LLM1*, or *OWASP MCP 2025:MCP1*. This helps you understand and prioritize issues based on recognized industry standards.                                                                                                                                               |
| **Last Seen**            | Specifies the most recent occurrence of the issue. This helps you determine whether the issue is still active, has reappeared, or is no longer a threat.                                                                                                                                                                                                                             |

#### Grouping and filtering options

While Harness groups the issues on the page based on their name, you can filter and group issues based on several criteria:

**Group By**

| Category                 | Description                                                                                                                                                                                                                                                                                                                                     |
| ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **None**                 | Displays each issue as a separate entry, without grouping.                                                                                                                                                                                                                                                                                      |
| **Issue Name**           | Groups issues based on the specific issue. This helps you understand how widespread an issue is across environments and focus on resolving the most recurring issues.                                                                                                                                                                           |
| **Category**             | Groups issues by broader classifications, such as Authentication, Authorization, JSON Web Token, or MCP Tools. This helps you analyze the issues from a broader perspective and identify which are most common across the system.                                                                                                               |
| **Framework References** | Groups issues based on their framework reference mappings, such as OWASP API, OWASP LLM, or OWASP MCP risks. This helps you align your analysis with recognized industry standards.                                                                                                                                                             |
| **Asset**                | Groups issues based on the asset in which they were detected, such as an API endpoint or an AI Asset. This helps you analyze the risk exposure for each asset and prioritize resolution accordingly.                                                                                                                                            |
| **Application Name**     | Groups issues based on the application associated with the affected asset. This helps you identify the applications with the most issues and prioritize their remediation.                                                                                                                                                                      |
| **Owner**                | Groups issues based on the assigned owner of the API. This helps you direct these issues to the right individual or team for faster and effective resolution. For more information on ownership and its assignment, see [API Ownership](/web-application-and-api-protection-waap-protection-protection/discovery/discovery-1/api-ownership.md). |
| **Label**                | Groups issues based on the labels assigned to APIs. This helps you assess and prioritize issues by business function, risk, or internal tagging conventions.                                                                                                                                                                                    |
| **Domain**               | Groups issues based on the domain of the API where the issue was detected. This helps you assess and prioritize issues by the application area or team affected.                                                                                                                                                                                |

To group the issues using either of the above criteria, use the **Group by** drop-down, as shown in the image above.

**Filters**

Narrow the issues based on options, such as status, severity, source, timestamp, or sensitivity, ensuring that you can analyze them accordingly. To filter the issues based on your requirements, use the **Filter** (<i class="fa-filter">:filter:</i>) icon, as shown in the image above.

<figure><img src="https://1414883571-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdr7UJpJrdGkkSGT6AFTu%2Fuploads%2FBkIxeFB36zSErMmV3UEz%2Fdiscovery_issues_filters.png?alt=media&amp;token=1214f3fa-3b63-4c3b-8d06-62bd152f4b6e" alt=""><figcaption></figcaption></figure>

For information on managing issues based on the above groups and filters, see [Issue Management](/web-application-and-api-protection-waap-protection-protection/discovery/risk/issue-management.md).

{% @harness-feedback/feedback %}