Findings page
Every finding heyGRC posted on your pull requests, one row per finding, with its control and your policy. Filter, open the review, export to CSV.
The Findings page in the console (app.heygrc.com, Findings in the sidebar) lists every finding heyGRC posted on your pull requests, one row per finding. Use it for a weekly check, for your ISMS metrics, or to answer "what did the reviews raise this month?" without opening each pull request.
It is on every plan, free included, and every member of the org can open it.
What each row shows
| Column | What it holds |
|---|---|
| Last seen | The last time heyGRC raised this finding, with First seen underneath. A finding repeated across pushes on the same pull request stays one row. |
| Repository #PR | The repository and pull request the finding was posted on. |
| Severity | Critical, High, Medium, Low or Info. |
| Finding | The finding's title. |
| Controls | The framework controls the finding cites, for example ISO 27001 A.8.15. |
| Your policy | When the finding quoted one of your own policies, the policy's name. Hover it to read the quoted rule; the link opens the source. Empty when no policy of yours applied. See Where your policies live. |
| Link | Open on GitHub goes to the exact heyGRC review on the pull request (or to the pull request when the review link is not available). |
Filters
- Range: Last 7 days, Last 30 days, Last 90 days, This month, Last month.
- Severity: toggle each severity; each one shows its count for the range.
- One pull request: click a review on the Reviews dashboard (or View findings under a milestone, see Milestones) and the page opens filtered to that pull request. Show all pull requests clears it.
The Findings tile on the Reviews dashboard opens this page with the dashboard's date range.
Export to CSV
Download CSV exports the rows that match your filters. Columns: First seen, Last seen, Repository, PR, Severity, Finding, Controls, Your policy, Policy rule, Link.
- The CSV is built in your browser and holds up to 2,000 rows. Above that, the console tells you how many it kept.
- Cells that a spreadsheet could run as a formula are neutralised.
- Code snippets and the suggested fix are not in the CSV; open the review on GitHub for those.
What it does not do
- No statuses. There is no resolved, dismissed or accepted state on a finding here. For a report by control that shows whether each finding was re-flagged in a later full review, see Audit evidence. The record of what the team did lives on the pull request (with GitHub's conversation-resolution rule, each inline finding is resolved before merge). See Does heyGRC block merges?.
- No framework or repository filter, no search on this page yet.
- No API. Findings are not available through the heyGRC API, API keys or MCP; use the CSV.
Using it for your ISMS
- Weekly check: Last 7 days, High and Critical only, then open each review on GitHub.
- Metrics: This month or Last month, Download CSV, and count by severity or by control in your spreadsheet.
- Audit sampling: each row links to the pull request where the finding was raised and handled.