# Findings and reports

> Record Red Team findings with severity, evidence and remediation in Oyster, and curate them into a report that tells a clean story.

Source: https://documentation.redorca.ai/guides/red-team/findings-and-reports/
Last updated: 2026-11-01

A finding is a recorded security observation, with severity, evidence and, ideally, a fix. Findings live in **Findings** in the sidebar; how to save, share and publish them is in [Findings and sharing](https://documentation.redorca.ai/guides/findings/).

## Reading a finding

- **Severity** reflects impact and exploitability. Treat it as a prioritisation aid, not an absolute.
- **Evidence** is what makes a finding credible: the request and response, the output, or the citation behind it.
- **Remediation** should be specific and testable. [Fix Advisor](https://documentation.redorca.ai/guides/red-team/fix-advisor-and-code-lab/) turns a finding into concrete steps.
- A finding without evidence is a hypothesis. Capture the proof before you report it.

## Producing a useful report

1. Capture findings from chat as you work (**save as Finding** on an answer), or log them by hand.
2. Give each a clear title, a severity, the affected endpoint and the evidence.
3. Attach remediation from Fix Advisor.
4. Choose **Add to Report** for the findings that belong in the report, so it tells a clean story: what, impact, proof, fix.

Findings are private by default.