Reserved keys: report and PoC

Post-scripts emit ordinary output keys, but two names are reserved and get special treatment in the finding view: _reserved_report and _reserved_poc.

_reserved_report

Emit a key named _reserved_report (a Markdown string) and open·kritt renders it as a dedicated Report tab on the finding, formatted as Markdown.

_reserved_poc

Emit _reserved_poc (also Markdown) and it appears as a PoC tab on the finding.

Note

These are output keys, not post-script names. Your post-script keeps a normal name (e.g. "Report writer") - it just emits a field called _reserved_report or _reserved_poc in its output.

Example

A single post-script can produce a grade, a full report, and a PoC at once:

For "{{summary}}" ({{vulnerability_type}}) at {{file_path}}:{{line}}, produce:

Return:
- severity (string): CRITICAL, HIGH, MEDIUM, LOW
- _reserved_report (string): a full Markdown report
- _reserved_poc (string): Markdown with reproducible exploit steps

On the finding page this renders as:

• an Overview tab (always present),
• a Report tab (because _reserved_report is present),
• a PoC tab (because _reserved_poc is present), and
• a Post-script tab for any other custom keys (like severity).

Info

The reserved keys are handled in the finding view. Any non-reserved keys you emit show up under the Post-script tab as plain fields, and short values can also surface as chips in the findings list.

Next: chips output.