Linking techniques and editing findings¶
The editor¶
A finding is written in the finding editor: title, executive summary, technical description, recommendation, severity and its CVSS vector, disposition, evidence, and the techniques it covers. The editor writes a working copy; publishing it is a separate, deliberate step (see Findings).
Linking techniques is what drives the mappings¶
Linking a finding to one or more techniques is the single most consequential edit, because the technical mappings (WSTG, ASVS, CWE) and, through the crosswalk, the related compliance controls are derived from the linked techniques, live. You do not tag mappings by hand; you link the techniques that cover the finding and the Mappings card fills itself, updating if you change the links or the catalogue. A finding with no technique linked carries no mappings and no compliance, which the findings list now shows at a glance so the gaps are visible.
Compliance controls, derived and curated¶
The compliance controls on a finding are derived from its CWE codes through the frozen crosswalk. An expert can add, remove or refine a control on a finding; a curated finding shows a marker, and the curated overrides freeze while the derived baseline stays live. The report checkpoint at release presents these for a last review. None of this asks the pentester to tag anything; it rides on the technique links.
When there is no control at all, the card says why, because the three reasons ask for different reactions. The finding may carry no CWE, and then there is nothing to derive; it may carry CWEs the bundled crosswalk does not cover, and then the classification is right and it is derivation that does not reach those codes; or it may carry a code written in a shape derivation never looks up, and that one is marked on the chip itself, because it is the only case where the screen looked classified without being so.
Excluding a mapping that does not apply¶
A technique states what it investigates, and a finding produced by it may only realise part of that. So a code inherited from a linked technique can be excluded on the finding: the Mappings card marks it as not applying here, the report stops citing it, and the compliance controls derived from it follow. The exclusion changes nothing in the catalogue, and unlinking the technique is no longer the only way to keep a wrong code out of a report. The card shows how many are excluded, so the decision stays visible.
Editing the same finding as someone else¶
Entering edit mode takes a short lock on the finding, renewed while you work and released when you leave the editor, switch findings or close the page. Someone else opening the same finding sees that it is being edited and by whom, rather than silently overwriting your work. An abandoned lock expires on its own after fifteen minutes, and an administrator can release one explicitly, which is recorded in the audit trail. The automatic releases never take someone else's lock, whoever is signed in.
Saving and publishing¶
Save writes your working copy, and you do not have to remember to do it: while an edit is open, the editor writes on its own, after a pause in typing and under a time ceiling for whoever types without pausing, through the same path the button takes. The "all saved" indicator tells the truth as a consequence. Automatic saving exists while you hold the lock; if the lock is lost it stops, and whatever is on screen exists only there again, which is the moment to copy your text before leaving.
Publishing validates the required fields and creates an immutable revision the client sees; it flushes your pending edits first, so a summary you just typed is considered rather than refused as missing. Once published, a finding cannot be deleted, only superseded by a new revision.
The publish control only offers itself when there is a reason, and it says which: "publish" for a finding the client has never seen, "publish changes" for one they already have that has moved since. When the client already has exactly this, the control sits inert and explains itself, rather than walking you through an irreversible-action warning to tell you at the end that nothing changed.