# Findings and fixes

> How Airship proves a finding, and how it turns one into a pull request.

## Proof-of-exploit

A scanner that guesses produces noise. Airship validates each finding against your live environment and reports it only when it can exploit it. Every finding includes:

- a proof-of-exploit
- reproduction steps, so you can see it for yourself

There are no theoretical risks in the list, only confirmed, exploitable vulnerabilities.

## Auto-fix

For a confirmed finding, Airship:

1. generates a fix
2. retests to confirm the vulnerability is gone
3. delivers a merge-ready pull request

You review it, merge it, and you're done.

## Your source code

Your source code is never stored or used for model training. All model providers operate under zero data retention agreements. Scan results are kept with your account so you can read them later, and you can ask for them to be deleted at any time. See the [privacy policy](/privacy).

Enterprise customers can self-host in their own VPC, on-premise or in an air-gapped environment.