Skip to main content
Effectively managing vulnerability findings is crucial for improving your security posture. This guide covers the complete findings workflow.

​
Findings Overview

Each finding includes:

Severity Rating

Critical, High, Medium, Low, Informational

Vulnerability Type

Category (XSS, SQLi, IDOR, etc.)

Evidence

Screenshots, requests, payloads

Remediation

Step-by-step fix guidance

​
Severity Levels

LevelDescriptionSLA Recommendation
CriticalImmediate exploitation risk, data breach potentialFix within 24 hours
HighSignificant security impactFix within 7 days
MediumModerate risk with mitigating factorsFix within 30 days
LowMinor security concernFix within 90 days
InformationalBest practice recommendationsReview at discretion

​
Finding Details

Brief description of the vulnerability and its impact.
  • Affected endpoint
  • Vulnerable parameter
  • Attack payload used
  • Request/response data
Working exploit demonstrating the vulnerability:
curl -X POST 'https://example.com/api/users' \
  -d "id=1' OR '1'='1"
Analysis of how this vulnerability affects your business:
  • Data exposure risk
  • Compliance implications
  • Reputation impact
Specific guidance for fixing the vulnerability with code examples.

​
Workflow States

1

New

Newly discovered vulnerability awaiting review.
2

Confirmed

Validated by team, acknowledged as genuine issue.
3

In Progress

Fix is being developed.
4

Fixed

Remediation deployed, awaiting verification.
5

Verified

Retest confirmed the fix is effective.

​
Filtering Findings

Use filters to focus on what matters: 
# Filter examples
severity:critical,high
status:new,confirmed
target:production-app
type:injection
discovered:this-week

​
Bulk Operations

Manage multiple findings at once:
  • Bulk Status Update: Move multiple findings to new state
  • Bulk Assignment: Assign to team member
  • Bulk Export: Download selected findings
  • Bulk Ignore: Mark false positives
Use bulk ignore carefully. Document reasons for ignoring findings.

​
Retesting

After applying fixes:
  1. Mark finding as Fixed
  2. Click Request Retest
  3. AI agent verifies the fix
  4. Finding moves to Verified or returns to Confirmed
Automated retesting runs during each assessment to catch regressions.

​
False Positives

If a finding is not a genuine vulnerability:
  1. Click Mark as False Positive
  2. Add justification explaining why
  3. Finding is excluded from future reports
  4. AI learns from feedback to reduce similar false positives

​
Integration with Issue Trackers

Export findings to:
  • Jira
  • GitHub Issues
  • GitLab Issues
  • Linear
  • Custom webhooks
Configure integrations in Settings → Integrations.

​
Next Steps

Generate Reports

Create stakeholder-ready documentation.

API Reference

Automate findings management via API.