Sample output

What Netlumi gives you.

A finding with its evidence, the fix as a pull request with what was checked, what happens after the merge, and why the list stays short. Every name here is made up.

Scan a repo free, no signupThe AI agent example

The finding

A finding.

Each finding names the resource, the evidence, the IaC file and line that created the resource, the commit and its author, and the one action to take now.

Example finding

Critical

prod-data-bucket

S3 bucket · account 1111… · us-east-1

Public access not blocked

Confidence: proven · Live: seen 4 minutes ago

ExposedAnyone on the internet can read objects in this bucket
Open to the internetNothing in the account blocks public access
ConfirmedAn anonymous read of one object succeeded
Data at risk12,418 objects, 3.1 GB; on 2 attack paths to acme-customers
terraform/aws/s3.tf:14-22resource "aws_s3_bucket_public_access_block" "prod_data"commit 8f2c1d4 · J. Doe · 2 days ago

One action now: review the fix pull request #284.

What the fields mean

Severity
Critical or high only when the evidence shows the issue matters in your account. Otherwise medium, low or posture.
Confidence
Proven means Netlumi confirmed the effect in your account.
Live
When the resource was last seen in a scan. A finding on a resource that is gone is closed, not left open.
Code-to-cloud
The file, line range and commit that created the resource, so the fix goes where the resource is defined and to the team that owns it.
Attack paths
The paths this finding is on, so you can see whether it opens a route to your data.

The fix

The fix, as a pull request.

Netlumi writes the change in the IaC code that created the resource and opens a pull request. Fix pull requests are checked before you see them, and never applied for you. You review and merge.

Example pull request

Open

fix: Public access not blocked for prod-data-bucket

#284 · netlumi/fix-s3-public-access-prod-data-bucket into main · opened by Netlumi Fix

Security Fix: Public access not blocked

Automated fix generated by Netlumi. Resource: prod-data-bucket · Severity: critical · Region: us-east-1 · Account: 1111…

Verification

Tested against your account: the finding no longer fires with this change.

  • Plan: 0 to add, 1 to change, 0 to destroy (0 replaced).
  • Re-checked against prod-data-bucket: the finding is resolved by this change.
  • Not checked: the bucket policy itself is unchanged; review it if objects must stay public.
terraform/aws/s3.tf+4 -4

- block_public_acls = false

- block_public_policy = false

+ block_public_acls = true

+ block_public_policy = true

Closes 1 critical issue on prod-data-bucket; breaks 2 attack paths. Compliance: CIS AWS Foundations 2.1.4, SOC 2 CC6.1.

Merge pull request

What the pull request carries

  • The finding: resource, severity, category, region and account, and the issue in plain words.
  • The plan: what would be added, changed, destroyed or replaced. A fix that would destroy or replace a resource is blocked.
  • The check: whether the change resolves the finding. If it does not, there is no pull request.
  • What was checked and what was not, so your review starts where the automation stopped.
  • What it closes: the issues and the attack paths it breaks, and the controls it maps to.

Opened by the Netlumi Fix app on a netlumi/fix-* branch. Never pushed to your default branch, never merged by Netlumi.

After the merge

Stays fixed after the next deploy.

A fix applied by hand to the live resource is undone by the next deploy from your IaC code. A fix in the code is applied by it.

Example: after the merge

Merged
Your pipeline applies the changethe deploy sets the public access block from the codeApplied
Next scan, 3 hours laterthe finding is no longer reported on prod-data-bucketNo longer reported
Drift checkthe live bucket matches terraform/aws/s3.tfIn sync
A later manual change in the consolesomeone turns the block off by hand: a drift event names who and whenDrifted

The fix is in the code, so the next deploy applies it instead of undoing it.

  • Scans run on a schedule and when things change. After the merge and the deploy, the next scan no longer reports the finding.
  • Drift detection compares each live resource with its IaC code and shows what changed, who changed it, and whether the change went through your pipeline.
  • The merged pull request is recorded as evidence for your compliance report: what was wrong, the pull request that fixed it, and when.

Less noise

The low-noise model.

Critical and high mean something you do something about today. Netlumi marks an issue critical or high only when the evidence shows it matters in your account.

  • Each finding shows its evidence, as in the example above.
  • Attack paths: Netlumi shows which steps of a path it has confirmed in your account and which it has not, and why.
  • Urgent alerts are rare and reach you at once. Everything else goes into a daily digest. Our automatic remediation workflow keeps fixing issues in the meantime.
  • Severity is never decided by a language model.