Sample output

What Netlumi gives you.

A finding with its evidence, the fix as a pull request with its plan line and re-check, what happens after the merge, and the model that keeps the list short. Every name here is made up.

Scan a repo free, no signup The AI agent example

A finding.

Each finding names the resource, the evidence for each of the four tests, the IaC file and line that created the resource, the commit and its author, and the one action to take now.

Example finding

Critical

prod-data-bucket

S3 bucket · account 1111… · us-east-1

Public access not blocked

Confidence: verified · Live: seen 4 minutes ago

Exploitable	Bucket policy allows s3:GetObject to everyone; no public access block on the bucket
Reachable	No account-level public access block; no SCP denies it
Verified	An anonymous read of one object succeeded
Consequential	12,418 objects, 3.1 GB; on 2 attack paths to acme-customers

terraform/aws/s3.tf:14-22resource "aws_s3_bucket_public_access_block" "prod_data"commit 8f2c1d4 · J. Doe · 2 days ago

One action now: review the fix pull request #284.

What the fields mean

Severity: Critical or high only when all four tests pass with evidence named. Otherwise medium, low or posture.
Confidence: Verified means we tested the effect, not inferred it from a setting or a name. Anything not verified stays at medium or below.
Live: When the resource was last seen in a scan. A finding on a resource that is gone is closed, not left open.
Code-to-cloud: The file, line range and commit that created the resource, so the fix goes where the resource is defined and to the team that owns it.
Attack paths: The paths this finding is on, so you can see whether it opens a route to your data.

The fix, as a pull request.

Netlumi writes the change in the IaC code that created the resource, plans it against your real state, re-checks the finding against the planned change, and opens the pull request. You review and merge.

Example pull request

Open

fix: Public access not blocked for prod-data-bucket

#284 · netlumi/fix-s3-public-access-prod-data-bucket into main · opened by Netlumi Fix

Security Fix: Public access not blocked

Automated fix generated by Netlumi. Resource: prod-data-bucket · Severity: critical · Region: us-east-1 · Account: 1111…

Verification

Verified: the finding no longer fires on the planned change.

Plan: 0 to add, 1 to change, 0 to destroy (0 replaced).
Re-checked against prod-data-bucket: the finding is resolved by this change.
Not checked: the bucket policy itself is unchanged; review it if objects must stay public.

terraform/aws/s3.tf+4 -4

- block_public_acls = false

- block_public_policy = false

+ block_public_acls = true

+ block_public_policy = true

Closes 1 critical issue on prod-data-bucket; breaks 2 attack paths. Compliance: CIS AWS Foundations 2.1.4, SOC 2 CC6.1.

Merge pull request

What the pull request carries

The finding: resource, severity, category, region and account, and the issue in plain words.
The plan: what would be added, changed, destroyed or replaced. A fix that would destroy or replace a resource is blocked; a failed or skipped plan never yields a pull request.
The re-check: the finding, evaluated again against the planned change. If it is still there, there is no pull request.
What was checked and what was not, so your review starts where the automation stopped.
What it closes: the issues and the attack paths it breaks, and the controls it maps to.

Opened by the Netlumi Fix app on a netlumi/fix-* branch. Never pushed to your default branch, never merged by Netlumi.

Stays fixed after the next deploy.

A fix applied by hand to the live resource is undone by the next deploy from your IaC code. A fix in the code is applied by it.

Example: after the merge

Merged

Your pipeline applies the changethe deploy sets the public access block from the codeApplied

Next scan, 3 hours laterthe finding is no longer reported on prod-data-bucketNo longer reported

Drift checkthe live bucket matches terraform/aws/s3.tfIn sync

A later manual change in the consolesomeone turns the block off by hand: a drift event names who and whenDrifted

The fix is in the code, so the next deploy applies it instead of undoing it.

Scans run on a schedule and when things change. After the merge and the deploy, the next scan no longer reports the finding.
Drift detection compares each live resource with its IaC code and shows what changed, who changed it, and whether the change went through your pipeline.
The merged pull request is recorded as evidence for your compliance report: what was wrong, the pull request that fixed it, and when.

The low-noise model.

Critical and high mean something you do something about today. An issue is critical or high only when it passes all four tests, with the evidence named.

Test	Means	Evidence, for example
Exploitable	the condition lets someone act, not just a setting that could	Bucket policy allows s3:GetObject to everyone; no public access block on the bucket
Reachable	the actor can get to it	No account-level public access block; no SCP denies it
Verified	we checked, not inferred	An anonymous read of one object succeeded
Consequential	something is lost	12,418 objects, 3.1 GB; on 2 attack paths to acme-customers

Attack paths: each hop is checked against your account’s permissions. A path that is not confirmed is capped at medium and says why. “Not confirmed” is a state with a reason, never a downgrade to “fine”.
One issue per root cause: a bucket with three related settings wrong is one issue with three pieces of evidence, not three findings.
Every verified critical reaches you at once. Beyond that, at most one urgent alert per account a week; the rest goes into the daily digest. Our automatic remediation workflow keeps fixing them meanwhile.
Severity is never decided by a language model.