@@ -946,6 +946,7 @@ def sast_counts(db, names, user=None) -> dict:
                 Finding.repository, Finding.severity, func.count(Finding.id))
             .filter(Finding.repository.in_(names))
             .filter(Finding.state == FindingState.OPEN)
+            .filter(Finding.excepted.is_(False))
             .filter(Finding.out_of_scope.is_(False))
             .group_by(Finding.repository, Finding.severity).all()):
         out.setdefault(repo, {})[getattr(severity, "value", str(severity))] = total
@@ -960,12 +961,99 @@ def sast_findings(db, names, limit: int = 80, user=None) -> list:
              Severity.LOW: 3}
     rows = (_findings(db, user).filter(Finding.repository.in_(list(names) or [""]))
             .filter(Finding.state == FindingState.OPEN)
+            .filter(Finding.excepted.is_(False))
             .filter(Finding.out_of_scope.is_(False))
             .filter(Finding.severity.in_(list(order))).limit(2000).all())
     rows.sort(key=lambda f: (order.get(f.severity, 9), -(f.risk_score or 0)))
     return rows[:limit]
 
 
+# How a code finding is named everywhere: GCR- and twelve hex digits.
+_VULN_ID = re.compile(r"\bGCR-[0-9A-F]{12}\b")
+
+
+def settled_sast(db, ids) -> set:
+    """The code findings among these ids a person took out of the counts.
+
+    An exception (an approved waiver or an exclusion rule sets excepted), a
+    not deployed scope, or a false positive, which is a regrade to info.  A
+    fixed finding is not here: it was real, and saying so is still true.
+    """
+    from app.core.models import Severity
+
+    ids = sorted({i for i in ids if i})
+    if not ids:
+        return set()
+    out = set()
+    for start in range(0, len(ids), 500):
+        for vuln_id, excepted, out_of_scope, state, severity in (
+                db.query(Finding.vuln_id, Finding.excepted, Finding.out_of_scope,
+                         Finding.state, Finding.severity)
+                .filter(Finding.vuln_id.in_(ids[start:start + 500])).all()):
+            if (excepted or out_of_scope or state == FindingState.WAIVED
+                    or severity == Severity.INFO):
+                out.add(vuln_id)
+    return out
+
+
+def _cites(text, settled) -> bool:
+    return any(i in settled for i in _VULN_ID.findall(str(text or "")))
+
+
+def _drop_sentences(text, settled) -> str:
+    parts = re.split(r"(?<=[.!?])\s+", str(text or ""))
+    return "  ".join(p for p in parts if not _cites(p, settled)).strip()
+
+
+def scrub_review(db, review: dict, findings: list = None,
+                 text: str = "summary", lists=("priorities", "next_steps")) -> dict:
+    """A saved model answer, less what it said about settled code findings.
+
+    The answer is kept as it was written, so a finding somebody later called
+    a false positive or gave an exception would go on being reported.  This
+    is applied every time one is shown.  The summary goes whole when it names
+    one, since the sentences around the id are about the same code.  Returns
+    a copy, with "withheld" set to how many settled findings it named.
+    """
+    review = dict(review or {})
+    findings = findings if findings is not None else []
+    seen = set()
+    for value in [review.get(text)] + [x for k in lists for x in review.get(k) or []]:
+        seen.update(_VULN_ID.findall(str(value or "")))
+    for c in review.get("correlations") or []:
+        if isinstance(c, dict):
+            seen.update(_VULN_ID.findall(str(c.get("sast") or "")))
+    for f in findings:
+        seen.update(_VULN_ID.findall(str(f.get("ai_sast") or "") + " " + str(f.get("ai_why") or "")))
+    settled = settled_sast(db, seen)
+    review["withheld"] = 0
+    if not settled:
+        return review
+    named = set()
+    for value in [review.get(text)] + [x for k in lists for x in review.get(k) or []]:
+        named.update(i for i in _VULN_ID.findall(str(value or "")) if i in settled)
+    if _cites(review.get(text), settled):
+        review[text] = ""
+    for k in lists:
+        if review.get(k):
+            review[k] = [x for x in review[k] if not _cites(x, settled)]
+    if review.get("correlations"):
+        kept = []
+        for c in review["correlations"]:
+            if isinstance(c, dict) and _cites(c.get("sast"), settled):
+                named.update(i for i in _VULN_ID.findall(str(c.get("sast"))) if i in settled)
+                continue
+            kept.append(c)
+        review["correlations"] = kept
+    for f in findings:
+        if _cites(f.get("ai_sast"), settled):
+            f["ai_sast"] = ""
+        if _cites(f.get("ai_why"), settled):
+            f["ai_why"] = _drop_sentences(f["ai_why"], settled)
+    review["withheld"] = len(named)
+    return review
+
+
 RANK = {"critical": 4, "high": 3, "medium": 2, "low": 1, "info": 0, "none": 0}
 
 
@@ -1325,6 +1413,11 @@ def scan_dict(scan: ExternalDastScan, findings: bool = False) -> dict:
             out["ai"]["summary"] = json.loads(scan.ai_summary or "{}")
         except ValueError:
             out["ai"]["summary"] = {}
+        from sqlalchemy.orm import object_session
+
+        db = object_session(scan)
+        if db is not None and isinstance(out["ai"]["summary"], dict):
+            out["ai"]["summary"] = scrub_review(db, out["ai"]["summary"], out["findings"])
     return out
 
 
@@ -2671,7 +2764,9 @@ def recover() -> int:
 {"summary": "three to five sentences for an engineer, plain US English",
  "verdicts": [{"id": "finding id", "verdict": "likely_real", "why": "one sentence",
    "sast": "matching SAST finding id or empty"}],
- "priorities": ["the three things to fix first, one sentence each"]}"""
+ "priorities": ["the three things to fix first, one sentence each"]}
+
+Whenever you mention a SAST finding, give its id (GCR- and twelve characters)."""
 
 RISK_SYSTEM = """You assess the security risk of one public web site from two \
 sources: what a dynamic scan (DAST) found on the live site and what static \
@@ -2684,7 +2779,9 @@ def recover() -> int:
  "summary": "four to six sentences in plain US English for a business owner",
  "correlations": [{"dast": "DAST finding title", "sast": "SAST finding id and rule", \
 "why": "one sentence"}],
- "next_steps": ["up to five actions, most important first"]}"""
+ "next_steps": ["up to five actions, most important first"]}
+
+Whenever you mention a SAST finding, give its id (GCR- and twelve characters)."""
 
 
 def _json_answer(text: str) -> dict:
 
@@ -664,6 +664,8 @@ def detail_page(asset_id: int, request: Request, scans: int = 1,
             review = json.loads(asset.ai_review or "{}") if asset.ai_review else {}
         except ValueError:
             review = {}
+        if isinstance(review, dict) and review:
+            review = external.scrub_review(db, review)
         active_scan = running.get(asset.id)
         busy = (asset.telemetry_status == "running" or asset.ai_status == "running"
                 or active_scan is not None
 
@@ -137,9 +137,10 @@ <h2 class="new-page" style="margin-top:0">1.  Document control</h2>
 
 <h2>2.  Executive summary</h2>
 {% for paragraph in narrative %}<p>{{ paragraph | sentence_spaced }}</p>{% endfor %}
-{% if ai_summary and ai_summary.summary %}
+{% if ai_summary and (ai_summary.summary or ai_summary.withheld) %}
 <h3>2.1  What the enhanced review found</h3>
-<p>{{ ai_summary.summary | sentence_spaced }}</p>
+{% if ai_summary.summary %}<p>{{ ai_summary.summary | sentence_spaced }}</p>
+{% else %}<p>{{ "The review's summary is left out.  It named code findings that have since been given an exception or marked a false positive.  Run the enhanced review again for a new one." | sentence_spaced }}</p>{% endif %}
 {% if ai_summary.priorities %}<ol>{% for p in ai_summary.priorities %}<li>{{ p | sentence_spaced }}</li>{% endfor %}</ol>{% endif %}
 <p class="faint">Written from the findings in section 4.  Check it against them.</p>
 {% endif %}
 
@@ -144,7 +144,8 @@
     {% if ai.status == 'running' or ai.status == 'wanted' %}<div class="faint">{{ 'Waiting for the scan to finish.' if ai.status == 'wanted' else 'Asking the model.' }}</div>
     {% elif ai.status == 'failed' %}<div class="notice bad"><div>{{ (ai.summary or {}).error or 'The model gave no usable answer.' }}</div></div>
     {% else %}
-      <p>{{ ai.summary.summary }}</p>
+      {% if ai.summary.summary %}<p>{{ ai.summary.summary }}</p>
+      {% elif ai.summary.withheld %}<div class="notice info"><div>The summary is hidden.  It named {{ ai.summary.withheld }} code finding{{ '' if ai.summary.withheld == 1 else 's' }} since given an exception or marked a false positive.  Use AI triage again for a new one.</div></div>{% endif %}
       {% if ai.summary.priorities %}<ol class="small">{% for p in ai.summary.priorities %}<li>{{ p }}</li>{% endfor %}</ol>{% endif %}
       <div class="small faint">The model's verdicts are shown on each finding below.  They do not change any severity.
         <a href="{{ here }}?verdict=likely_real">Likely real</a> &middot;
 
@@ -173,7 +173,8 @@
         {% elif asset.ai_status == 'failed' %}<div class="notice bad"><div>{{ asset.ai_error }}</div></div>{% endif %}
         {% if review %}
           <div><span class="badge {{ review.rating }}">{{ review.rating }}</span> <span class="small faint">{{ asset.ai_at | dt('%Y-%m-%d %H:%M') }}{% if review.model %}, {{ review.model }}{% endif %}.  Written by a model from the findings below: check it against them.</span></div>
-          <p>{{ review.summary }}</p>
+          {% if review.summary %}<p>{{ review.summary }}</p>
+          {% elif review.withheld %}<div class="notice info"><div>The summary is hidden.  It named {{ review.withheld }} code finding{{ '' if review.withheld == 1 else 's' }} since given an exception or marked a false positive.  Read it again for a new one.</div></div>{% endif %}
           {% if review.correlations %}<div class="small"><strong>Seen in both the site and the code</strong>
             {% for c in review.correlations %}<div style="margin:.25rem 0">{{ c.dast }} &harr; <span class="mono">{{ c.sast }}</span><div class="faint">{{ c.why }}</div></div>{% endfor %}</div>{% endif %}
           {% if review.next_steps %}<div class="small" style="margin-top:.5rem"><strong>Next</strong><ol>{% for s in review.next_steps %}<li>{{ s }}</li>{% endfor %}</ol></div>{% endif %}
 
@@ -4,6 +4,16 @@ Newest first.  Written for somebody deciding whether to upgrade, so every entry
 says what is different for a person using the product rather than which files
 moved.
 
+## 2026-11-05
+
+**DAST reports leave out code findings with an exception or a false
+positive.**  A scan's AI triage and a site's AI risk read keep what the model
+wrote, so a code finding given an exception afterward went on appearing in
+the PDF.  Now, when a saved summary names a code finding that has since been
+excepted or marked a false positive, the summary is hidden with a note to run
+it again, and any priority, next step, match or correlation naming one is
+dropped.  The code finding counts beside a site also leave out exceptions.
+
 ## 2026-11-04
 
 **Upgrades wait for running scans, and for a slow start.**  `install.sh
 
@@ -392,6 +392,14 @@ Every call is in the AI cost page under `dast-triage` or `external-risk`.  The
 scan and the site also keep their own token counts and cost.  Path traversal
 and script payloads in engine evidence are left out of what is sent.
 
+Code findings with an exception, a not deployed scope, or a false positive
+grade (info) are never sent, counted or shown.  A saved triage or risk read
+was written from the findings as they were at the time, so it is checked
+each time it is shown.  When its summary names a code finding that has since
+been excepted or marked a false positive, the summary is hidden, on the page
+and in the PDF, until it is run again.  Priorities, next steps, matches and
+correlations that name one are dropped.  A fixed finding is not hidden.
+
 ## API
 
 Make a token with the `external` scope.  Only an administrator can, and the