Findings & reports

Findings you don't have to second-guess

Every finding carries the exploit that proved it, ranked by severity with its CWE and the steps to fix it. Every run ends in a PDF report you can hand to anyone.

Start a scoped trialHow fixes are proven

Anatomy of a finding

Everything you need to act, in one place

Severity and classification

Critical to info, with CVSS and the CWE or CVE it maps to, so it slots into how you already rank risk.

The proof

The exact request and response that reproduce a blackbox finding, or the file and line of a whitebox one.

The fix

Remediation steps for every finding, and a ready fix pull request for eligible whitebox findings.

Working a finding

From found to fixed, with a trail

  1. 01

    Triage

    Filter every finding from every run by severity, status, repository or domain, and search them.

  2. 02

    Act on it

    Mark it fixed, snooze it or accept the risk. Every change is audited: who did it, and when.

  3. 03

    Send it on

    Create a Jira issue from the finding, or open a fix pull request for a whitebox one.

  4. 04

    Prove it's fixed

    Validate Fix replays the original exploit against your patch before you close the finding.

Reports

A PDF for every run

Download the report from Reports when a run ends: a shareable document with each finding, the steps to reproduce it and how to fix it.

  • Findings ordered by severity, each with its evidence
  • Counts and summaries computed from the run
  • Compare two runs of the same scope to show progress

Reports that hold up

Written for people

Each finding with the steps to reproduce it and how to fix it, laid out for engineers and stakeholders alike.

Numbers you can trust

Every count and every sentence about the assessment is computed from the run, never written by a model.

Progress over time

Compare two runs of the same scope to show exactly what was fixed between them.

Fix validation

Close findings only once the original exploit stops working.

How Validate Fix works

Blackbox & whitebox

Where findings come from: the live app, the source, or both.

Compare the two

Questions

Why are there so few false positives?
Because a finding is only kept once the agent has exploited it. Whatever the target returns, a 200, a 403 or an error page, is treated as a claim to check, never as proof. What reaches your list comes with the request and response, or the line of code, that proves it.
What format are reports in?
PDF. Every run produces one, downloadable from Reports, with the findings, the steps to reproduce each one and how to fix it.
Can I send findings to Jira?
Yes. Connect a Jira site and create an issue from any finding, in the project you choose.
What does the free plan show?
Every finding from your free pentest. High and critical findings show as a preview until you choose a plan, and opening a fix pull request for one needs a paid plan.
Is accepting a risk tracked?
Yes. Fixing, snoozing and accepting the risk on a finding are all audited with who made the change and when.