Evidence and the annotator

Capturing evidence

Evidence is attached to a finding (or to a retest). You add it by pasting a screenshot or dropping a file into the evidence area of the editor. Evidence is the most sensitive asset PEART holds, because it routinely carries credentials, tokens and personal data, so it is encrypted at rest at the file level (see Encryption).

What ingestion does

Uploaded images are not stored verbatim. The pipeline reads the image's real dimensions from its header and re-encodes it rather than trusting the file as-is; a format without safe pure-Go support is re-encoded to PNG. This closes the vectors where a hostile image file could carry more than an image, and it means the renderer only ever sees content that cannot reach out to an external reference.

The annotator

The annotator lets you mark up a captured image, to point at the part that matters and to redact what should not leave your hands. Redaction is a first-class step, not an afterthought, because a screenshot that carries a live credential into a client report is exactly the leak the whole product is built to prevent. Annotate to highlight the finding, redact to remove secrets and unrelated personal data, before the evidence goes anywhere near a report.

Evidence in the report

Client-facing report renditions of evidence are produced from the annotated, redacted version, and are served by the portal, which never holds the encryption key or reaches the original evidence directory. The original stays encrypted on the internal side; the client sees the rendition.

They are regenerated when the finding is published, and only then. That is why touching the evidence of an already published finding counts as a pending change: attaching, removing, recaptioning, reordering and reannotating all leave the finding marked as carrying a change the client has not received, and the portal lights its neutral revision mark until someone republishes. Until then the image the client holds is the previous one, with the previous annotation, and republishing is what updates it. It is also why publishing a finding whose text did not change still makes sense: the publish that creates no new revision still remakes the images.