Getting there #
Open any repository → click the Issues tab. The default view shows every issue from the most recent successful scan, sorted by severity (highest first).
The Issues tab shows deterministic findings only — the output of the pattern-matching rulesets. Results from the AI-powered scanners (Architecture / SOLID Analyzer and Prompt Scanner) live on a sibling AI Findings tab and are reviewed separately. See AI Findings.
What’s in the table #
Each issue is one row. The columns are:
| Field | What it tells you |
|---|---|
| Severity | How bad this issue is — HIGH, MEDIUM, or LOW. |
| Impact area | The category the rule belongs to — Security, Performance, Architecture, Maintainability, Scalability, or Manageability. |
| Rule | The name of the Norma rule that fired. Click for a longer description. |
| File | Where in your repository the issue was found. Click to see the file and line in context. |
| Line | Specific line number, or a range. |
| Recommendation | What Norma suggests changing. Available on most rules; some rules link to longer guidance. |
Click any row to expand the issue with the file snippet, the rule’s full description, and the fix recommendation.
Severity #
Norma uses three severities:
- High — this needs attention. Most security vulnerabilities and serious correctness issues land here.
- Medium — worth fixing. Performance issues, smaller security concerns, and structural problems that will compound.
- Low — best-practice nudges and style issues. Fix them when you’re in the area.
There’s no “Critical” severity in this release. Severity drives both the Issues-tab sort order and how each rule contributes to your Production Ready Score — see How the score is computed.
Impact areas #
Every issue is tagged with one impact area:
- Security — vulnerabilities, secret leaks, unsafe patterns (e.g. SQL injection, hard-coded credentials).
- Performance — patterns that are slow at scale (e.g. N+1 queries, blocking calls in async code).
- Architecture — design and structure (e.g. circular dependencies, leaky abstractions).
- Maintainability — readability, complexity, test coverage gaps.
- Scalability — patterns that work today but won’t survive growth.
- Manageability — operational concerns (logging, configuration, observability).
The Overview tab summarises issues by impact area in six cards. Click any card to filter the Issues tab to just that area.
Filtering and sorting #
Above the table, you’ll find filter controls:
- Severity — multi-select
HIGH,MEDIUM,LOW. Default is all. - Impact area — multi-select across the six areas.
- Search — type to filter by rule name or file path.
- Sort — by severity (default), file, or rule name.
Filters are additive — picking HIGH + Security shows only High-severity Security issues.
You can also use URL fragments to deep-link a filtered view (e.g. …/issues?severities=HIGH&categories=SECURITY). Useful when you want to send a teammate the specific subset you care about.
Drilling into an issue #
Click the row (or the rule name) to open the issue detail. You’ll see:
- Rule name and description — what the rule checks and why it matters.
- Severity and impact area chips.
- File path and a code snippet showing the offending lines with a few lines of context.
- Recommendation — what Norma suggests changing. Some recommendations are concrete code; others are more abstract guidance for rules where there’s no single right fix.
- Open in provider — a link straight to the file on GitHub or Bitbucket, at the right line.
What to fix first #
Use this priority order when you’re new to Norma or coming back to a repo after a while:
- The lowest-scoring area on the Overview tab. Open the Overview, find the area with the lowest score, click into it. Fixes there will move your overall Production Ready Score the most.
- Inside that area, fix
HIGHfindings beforeMEDIUMbeforeLOW. AHIGHfix moves a rule from 0 → 100; aLOWfix moves it from 75 → 100 — bigger lever, more score recovered. - High-severity Security issues anywhere. Even if Security isn’t your lowest-scoring area, every High-severity Security issue is a possible incident waiting to happen.
- Everything else — work through remaining Medium and Low issues as a clean-up backlog.
What a green Issues tab looks like #
You’re done when the Issues table is empty or shows only Low-severity findings you’ve consciously chosen to accept. The Overview will show:
- The READY chip next to the score.
- A Production Ready Score above the production-ready threshold.
- Six green-or-near-green area cards (or Not measured for areas with no applicable rules).
Related #
- Production Ready Score — the scoring rules behind the numbers.
- AI Findings — the parallel tab for AI-powered scanner results (SOLID Analyzer and Prompt Scanner), reviewed separately from deterministic issues.
- Glossary — definitions of every term used on the Issues tab.
