Recording a finding with evidence

Write the finding

In the finding editor, fill in the title, executive summary, technical description and recommendation, and set the severity (with its CVSS vector). These four text fields are what publishing will require, so a finding you intend to deliver needs them. The editor writes a working copy; nothing is published yet.

Link the techniques

Link the finding to the technique or techniques that cover it. This is the edit that pays off later: the technical mappings (WSTG, ASVS, CWE) and the related compliance controls are derived from the linked techniques, so you never tag them by hand. A finding with no technique linked carries no mappings, which the findings list shows at a glance so you can see the gap.

Add and redact evidence

Paste a screenshot or drop a file into the evidence area. Then use the annotator to point at what matters and, importantly, to redact anything that should not leave your hands: a screenshot carrying a live credential into a client report is the exact leak to avoid. Evidence is encrypted at rest, and the client only ever sees the redacted rendition, not the original.

Publish

When the finding is ready, publish it. Publishing validates the required fields and creates the immutable revision the client will see; it saves your pending edits first, so a summary you just typed counts. Once published, the finding can be superseded by a new revision but not deleted. Next: generating and releasing a report.