Skip to main content

Vulnerability view

Clicking a finding opens its detail page. The title is the finding's summary, and the content is organized into tabs.

The stat strip

Across the top you'll see the finding's key facts:

  • Severity - from the post-script's severity output (or "Unrated" if none).
  • Malicious actor - who can trigger it.
  • File - the file_path and line.
  • Vulnerability type - the classified category.

Tabs

Overview

Always present. The explanation, the location, the attack path (trigger_flow), a malicious input example, and any comments.

Report

Shown when a post-script emitted _reserved_report - a full Markdown write-up.

PoC

Shown when a post-script emitted _reserved_poc - reproducible proof-of-concept steps.

Post-script

Any other post-script output keys, shown as fields (severity, CVSS, CWE, and so on).

The finding schema

Every finding shares the same fixed shape, produced by the workflow's terminal step: summary, explanation, vulnerability_type, file_path, line, trigger_flow, malicious_input_example, malicious_actor, and an optional exploitable. This consistency is what makes findings comparable and lets post-scripts and rankers operate on them uniformly.

Next: errors and re-runs.