Findings, severity, disposition, retest

A finding is one issue you found and are writing up. It carries a title, an executive summary, a technical description, a recommendation, evidence, and links to the techniques it covers. Four of its concepts are worth understanding on their own, because they are state, not just fields.

Severity and class

Severity is the finding's rating (critical through informational), shown with both colour and a label so it never depends on colour alone. Class separates a vulnerability from an observation or a defect, so the report can treat them differently.

Disposition

Disposition is a declared decision about the finding (its handling), recorded with who set it and when, and a reason when it is anything other than the default. It is the human judgement about what to do with the finding, separate from whether it has been fixed.

Verification, derived from retests

Verification status is not something you set; it is derived from the finding's retests. Starting from open, an effective retest moves it to fixed, a partial one to partially_fixed, and an ineffective retest on a fixed or partial finding reopens it. The rule runs over the retests ordered by date, so the current status is always a consequence of what actually happened, not a field someone can contradict.

Publication

Publication is a two-axis state, not a single flag. A finding has a working copy that you edit, and a published revision that the client sees. From those two, PEART derives whether the finding is a draft, published, or published with a pending edit. Publishing validates that the required fields are present (title, executive summary, technical description, recommendation) and creates an immutable revision; the portal only ever reads the published revision, never your working copy. Once published, a finding can no longer be deleted, only superseded by a new revision.