FAQ
Answers to common questions about FPT AppSec for L1 Support.
1. Product overview
| # | Question | Answer |
|---|---|---|
| 1.1 | What is FPT AppSec? | FPT AppSec is an Application Security Posture Management (ASPM) platform that automatically detects vulnerabilities in source code (SAST), exposed secrets, IaC misconfigurations, and controls security quality before code is merged. All scan results are centralized in one place for security teams to monitor and resolve. |
| 1.2 | What scan types does FPT AppSec support? | Six scan types: SAST (source code analysis), Secret Scanning (detects exposed secrets/credentials), IaC Scanning (detects Infrastructure-as-Code misconfigurations), Image Scanning (detects vulnerabilities in container images), API Scanning (tests security of API endpoints), and SCA Scanning (analyzes third-party/open-source components). |
| 1.3 | Who is the target user of FPT AppSec? | DevSecOps teams, Security Engineers, and Developers who want to embed security controls into their software development lifecycle (CI/CD pipeline). |
| 1.4 | How many repositories can FPT AppSec scan simultaneously? | The system supports concurrent scanning of multiple repositories and multiple MR/PR requests at the same time. |
| 1.5 | How are issue severity levels classified? | Issues are classified into four levels: Critical, High, Medium, Low. Prioritize resolution from Critical downward. |
| 1.6 | What does Image Scanning check? | Image Scanning analyzes container images to detect vulnerabilities (CVEs) in OS packages and libraries inside the image. |
| 1.7 | How does API Scanning work? | API Scanning uses DAST methodology — it automatically sends requests to API endpoints to test for common security vulnerabilities (injection, broken authentication, data exposure, etc.). |
| 1.8 | What does SCA Scanning check? What is SBOM? | SCA Scanning analyzes third-party and open-source dependencies to detect known CVEs in the project. Results include a SBOM (Software Bill of Materials) — a full list of all detected dependency components. |
2. CI/CD integration
| # | Question | Answer |
|---|---|---|
| 2.1 | How does FPT AppSec integrate with CI/CD? | Via API/cURL calls embedded directly in the CI/CD pipeline. The system provides ready-made sample scripts (cURL examples) for each scan type so teams can integrate quickly. |
| 2.2 | Which CI/CD platforms does FPT AppSec support? | Integration is supported with multiple CI/CD platforms (GitLab CI, Jenkins, GitHub Actions, etc.) via API. |
| 2.3 | Why doesn't the repository appear in Asset Management? | A repository must be scanned at least once — via a CI/CD pipeline or a manual scan on the portal — before it appears in the system. Guide the customer to add the cURL scan to their pipeline and trigger a build again, or perform a manual scan directly on the portal. |
| 2.4 | Where are scan results returned? | Results are returned directly via the API response in the CI/CD pipeline. They are also visible in Asset Management and Asset Detail → Overview tab on the portal. |
3. Scan modes
| # | Question | Answer |
|---|---|---|
| 3.1 | What scan modes does FPT AppSec have? | Three modes: Full Scan (scans the entire repository), Commit Scan (scans a specific commit), and MR/PR Scan (scans the scope of changes in a Merge Request or Pull Request). |
| 3.2 | What is the difference between Full Scan, Commit Scan, and MR/PR Scan? | Full Scan scans the entire source code of the repository. Commit Scan scans only the changes in a specific commit. MR/PR Scan focuses on the scope of changes in an MR/PR using merge scan mode — suited for security quality control before merging. |
| 3.3 | How do I trigger an MR/PR Scan? | Add the merge scan mode cURL script to your CI/CD pipeline. The system provides ready-made scripts for Code Scan and Secret Scan in merge mode. |
| 3.4 | Where can I view scan results? | The PASS/FAIL result is returned via API in the pipeline. If a Security Gate is active, the PASS/FAIL status is also shown in Asset Management and Asset Detail. |
4. Security Gate
| # | Question | Answer |
|---|---|---|
| 4.1 | What is Security Gate? | An automated control mechanism that evaluates MR/PR scan results against pre-configured thresholds to determine whether an MR/PR should PASS or FAIL before merging. |
| 4.2 | What can Security Gate be configured to check? | Thresholds per scan type (Code Analysis, Secret Scanning, IaC Scanning) and per severity level (Max Criticals, Max Highs, Max Mediums, Max Lows). |
| 4.3 | What does a threshold value of 0 mean? | A value of 0 means block all issues at that severity level — even a single issue causes FAIL. Leaving a field blank means that condition is ignored. |
| 4.4 | Does Security Gate apply to new repositories? | Yes. When Security Gate is Active, all newly scanned repositories automatically have Security Gate applied. |
| 4.5 | Why does an MR/PR fail even though the code looks fine? | Check the Security Gate configuration — the threshold may be very strict (for example, Max Criticals = 0), or there may be issues from another scan type (Secret, IaC) exceeding the threshold. Review the detailed scan results in the pipeline or on the portal. |
| 4.6 | How do I disable Security Gate? | Go to Security Gate → click Disable → confirm in the popup. After disabling, all MR/PR scans will PASS without threshold checks. |
| 4.7 | How do I edit Security Gate thresholds? | Go to Security Gate → click Edit → modify the thresholds and the list of repositories it applies to → save. |
| 4.8 | Can Security Gate apply to specific repositories only? | Yes. In the Edit screen, users can select or deselect specific repositories from the Security Gate's applied list. |
5. Viewing results and managing issues
| # | Question | Answer |
|---|---|---|
| 5.1 | How do I view all issues for a repository? | Go to Asset Management, find and click the target repository — the system displays the corresponding issue list. |
| 5.2 | Where can I see the Security Gate status for each repository? | It is shown in Asset Management and in Asset Detail → Overview tab. |
| 5.3 | What statuses can an issue have? | Issues have three statuses: Open (detected, not yet resolved), Ignored (FP) (marked as False Positive), and Ignored (Accepted Risk) (risk accepted, no fix required). |
6. Access and accounts
| # | Question | Answer |
|---|---|---|
| 6.1 | Who has access to FPT AppSec? | Only users with FSP admin or FSP default permission in the portal's IAM module can access FPT AppSec. Users without permission see: "You do not have sufficient permissions to view this page!" |
| 6.2 | A customer says they cannot see the Security Gate button — what should I do? | Check the account's permissions — only FSP admin accounts can see and manage Security Gate. Ask the customer to sign in with an FSP admin account. |
7. Common errors
| # | Symptom | Common cause | Resolution |
|---|---|---|---|
| 7.1 | Repository does not appear in the system | Scan has never been triggered | Add the cURL scan to the CI/CD pipeline and re-run the build, or perform a manual scan on the portal |
| 7.2 | MR/PR always fails | Security Gate threshold is too strict, or there are real issues | Review the scan result log in the pipeline; revisit the threshold configuration |
| 7.3 | Cannot see Enable/Edit Security Gate button | Insufficient permissions (no FSP admin role) | Sign in with an account that has FSP admin permission |
| 7.4 | Scan returns no results | cURL script is misconfigured or API endpoint is wrong | Re-check the cURL script; ensure the endpoint and authentication token are correct |
| 7.5 | System shows a general error | System temporarily busy | Retry after a few minutes; if the error persists, escalate to L2 |