Chips output

A chip is a small inline tag shown next to a finding in the scan's findings list. Chips let a post-script surface an at-a-glance value - a CVE score, an exploitability verdict, a CWE - without opening the finding.

The _chip_ prefix

Any post-script output key that starts with _chip_ becomes a chip. The text after the prefix is used as the chip's label, and the value is shown next to it.

Return:
- _chip_cvss (string): the CVSS score, e.g. "9.1"
- _chip_exploitable (string): "yes" or "no"
- _chip_cwe (string): the CWE id, e.g. "CWE-89"

The example above renders three chips on the finding: cvss 9.1, exploitable yes, and cwe CWE-89.

How they behave

• The label is the key minus the _chip_ prefix.
• Chips are collected from the primary post-script answer and all enrichment post-scripts, so multiple scripts can contribute chips.
• Up to three chips are shown per finding in the list; each is width-capped and shows the full value on hover.

Note

Keep chip values short - they're meant for scannable, at-a-glance context. Put anything long in a normal output key or in a report.

That completes post-scripts. Next: why severity rankers?