​
Reports

Every audit produces a stored Markdown report, and you can export a PDF of the same report from the dashboard.

​
Report structure

Executive summary
  • One-paragraph overview of the engagement and its outcome
  • Remediation priorities with concrete deadlines by severity (Critical: immediate, High: within 72 hours, Medium: within 14 days)
  • Top findings called out
Scope and coverage
  • The requested, discovered, live, and scanned target lists
  • Technique execution matrix — every attack class attempted, with status (completed / partial / blocked / not applicable), attempts made, and findings produced
  • Completed checks that produced no reportable finding
  • Coverage gaps — anything that failed or couldn’t complete, with the reason
Findings
  • One section per finding, ordered by severity
  • Severity, class, source (agent / baseline), and verification badges in the header
  • Description, evidence block (the actual command output), and recommendation
  • CVE enrichment where applicable
Methodology and scoring
  • The full score breakdown: starting score, per-finding deductions with weights, risk score, coverage ceiling, and final score
  • How the score was computed, in plain language

​
Retrieving the report

Dashboard — open a completed audit and view or download the report; the PDF export renders the same content for stakeholders. API — the report endpoint returns a short-lived presigned URL to the stored Markdown file:
Returns 404 "Report not available yet" if the audit hasn’t finished.

​
Coverage-aware reporting

An audit that finished early or hit blockers reports it honestly: partial results are flagged, and the security score is capped so incomplete testing can never produce a perfect grade. The coverage sections exist so a clean-looking report always means “tested and clean,” not “barely tested.”

​
Next steps

Findings & Evidence

What goes into each finding.

Security Score

How the grade is calculated.