# Findings and evidence

> Read a published finding: CVSS severity, CWE classification, description, impact, recommendation and redacted HTTP evidence. Track its fix in the application.

## What a finding is

A finding is a weakness demonstrated during the pentest. It is only published if evidence accompanies it and if it has passed the attempt's automatic checks of perimeter, redaction and consistency. In the application, the **Findings** page lists them for the client space; a pentest's page shows its own.

## The fields of a finding

| Field | Content |
|---|---|
| Severity | The level (critical, high, medium, low, informational) and the CVSS score. |
| Classification | The CWE of the weakness. |
| Description | What was demonstrated, where, and how. |
| Impact | What an attacker would obtain. |
| Recommendation | The remediation leads. |
| Evidence | The redacted HTTP requests and responses, the proof of concept or the artefacts. |
| Confidence | The assessment of the reliability of the demonstration. |
| Target and date | The exact authorised target and the detection date. |

The same finding found again in several pentests of the same target is presented with its occurrences. A finding absent from the latest report is flagged as such.

## The evidence

The evidence is redacted before being persisted: secrets, tokens and test accounts are removed from it. The requests and responses can be read in the application with a code viewer; an artefact (for example a screenshot) is attached when it exists.

The raw execution traces, the internal working paths and the technical identifiers are never exposed.

## Track the fix

Each finding has remediation tracking: a status, a note, an owner, a due date and, for an accepted risk, a review date (at the latest within one year). Comments and the history of actions are kept. Your role determines whether you can change this tracking or only read it.

| Status | Meaning |
|---|---|
| To fix | The vulnerability remains to be fixed. |
| Fixed | The fix is deployed. If a next pentest finds the vulnerability again, it goes back to "To fix". |
| Risk accepted | The risk is knowingly assumed, with a review date. |
| False positive | The evidence does not apply to your context; the reason is required. |

A notification reminds you of a remediation deadline reached and of a review date reached.

A finding found again after being declared fixed is flagged as reopened, with the number of times this has happened.

## Have a fix verified

Prepare a retest batch from the fixed findings: see [Correction retests](https://docs.spectr-ai.eu/en/resultats/retests). The result of the counter-test appears in the finding's tracker: "the vulnerability was not reproduced" or "the vulnerability is still present".

## Export

The current view of the findings exports as Markdown from the **Findings** page. The final report, for its part, exports as PDF (see [The report](https://docs.spectr-ai.eu/en/resultats/rapport)).

> [!NOTE]
> The CVSS and CWE mapping structures the deliverable. It replaces neither your risk analysis nor a regulatory audit.

---

https://docs.spectr-ai.eu/en/resultats/findings-et-preuves