What problem does it solve? Security and code-review scans generate findings that are sometimes false positives, intentional behavior, or formally accepted risks. Without a structured dismissal process, these findings keep reappearing in every scan, drowning real issues in noise and leaving no audit trail for why something was ignored. ## Core Features & Use Cases - Fingerprint-based dismissal: Locate a finding by its FP-xxxxxxxx fingerprint across the code-review, security, and dynamic-scan ledgers, then move it to a Dismissed Findings section with a reason category (false-positive, wont-fix, accepted-risk, by-design) and a mandatory justification. - Auditable metadata: Records who dismissed the finding (from git config) and when, so every suppression is traceable. - Safety guardrails: Requires explicit yes/no confirmation, refuses empty justifications, blocks dismissal of Fixed findings, and warns when accepting risk on Critical/High severity findings or re-dismissing code that changed since a prior dismissal. - Undo support: The --undo flag moves a dismissed finding back to Open for re-triage. - Use Case: A security scan flags a SQL query as injectable, but a reachability guard prevents user input from reaching it. Run /dismiss with the fingerprint, the false-positive reason, and a justification so future scans stop re-reporting it unless the code changes. ## Quick Start Ask the AI to dismiss finding FP-a1b2c3d4 as a false positive with the justification that a reachability guard prevents user input from reaching the sink.
