Findings
Each finding is a vulnerability you discovered, with a title, a severity, an optional CVSS score, and a set of rich-text content fields.
Anatomy of a finding
| Part | What it is |
|---|---|
| Title | The vulnerability name, e.g. "SQL Injection in Login Form" |
| Severity | Critical High Medium Low Info, with customizable labels and colors |
| CVSS | A score from 0.0 to 10.0 and a full vector from the built-in CVSS v3.1 calculator |
| Content fields | Description, Details, Impact, and Remediation by default, fully customizable |
Adding a finding
- Open a report and switch to the Findings tab.
- Click Add Finding at the bottom of the sidebar.
- The template browser opens, so choose how to start:
- From a template: a pre-written finding with content already filled in (see Finding Templates).
- Start from scratch: a blank finding.
- The new finding appears in the sidebar and is selected automatically.
Editing a finding
At the top of the editor you'll find the severity badge (click to change level), the title, a CVSS button (shows the score, or "CVSS" if unset), and a ⋯ menu for deleting the field or the finding.
In the sidebar, expand a finding to see its fields. Click a field to load it; a purple dot marks fields that already have content. The default fields are:
- Description: what the vulnerability is
- Details: technical specifics, how you found it, proof of concept
- Impact: what an attacker gains
- Remediation: how to fix it
Every field is written in the same rich-text editor used for sections, with formatting, tables, images, and code.
Add, rename, reorder, or remove the default fields in Settings → Defaults. You can even attach a per-field AI prompt so Pro/Team drafting knows what each field should contain.
The CVSS v3.1 calculator
Click the CVSS button next to a finding's title to open the built-in calculator. Set the metrics, and the score and vector string are written onto the finding.
Severity levels
Click a finding's severity badge in the editor header to change its level. The five levels and their colors are configurable in Settings → Defaults, and they carry through to the exported DOCX as colored badges.
Reordering
Drag a finding by its row in the sidebar to reorder; a purple line shows where it will land, and the order saves automatically. You can also sort by severity (Critical-first or Info-first) with the sidebar's sort button.
Sorting by severity is a display convenience. Drag-and-drop sets the actual order used in your export.
Custom fields
Add a field to a single finding by expanding it in the sidebar, clicking Add field, typing a name, and pressing Enter. The field is added to that finding only.
To hide a default field that doesn't apply, select it, open the ⋯ menu, and choose Delete field. For default fields this hides them on that finding; for custom fields it removes them entirely.
Deleting a finding
Select the finding, open the ⋯ menu, choose Delete finding, and confirm. This permanently removes the finding and all its content.
Starting from templates
The template browser lets you drop in pre-written findings and tweak them per engagement. A fresh install ships with one example, SQL Injection, to show the format, and you build your own library from there.
See Finding Templates for creating, editing, and organizing your library.