Findings and reports

A finding is a recorded security observation, with severity, evidence and, ideally, a fix. Findings live in Findings in the sidebar; how to save, share and publish them is in Findings and sharing.

Reading a finding

• Severity reflects impact and exploitability. Treat it as a prioritisation aid, not an absolute.
• Evidence is what makes a finding credible: the request and response, the output, or the citation behind it.
• Remediation should be specific and testable. Fix Advisor turns a finding into concrete steps.
• A finding without evidence is a hypothesis. Capture the proof before you report it.

Producing a useful report

1. Capture findings from chat as you work (save as Finding on an answer), or log them by hand.
2. Give each a clear title, a severity, the affected endpoint and the evidence.
3. Attach remediation from Fix Advisor.
4. Choose Add to Report for the findings that belong in the report, so it tells a clean story: what, impact, proof, fix.

Findings are private by default.