Certificate and public verification

After a completed pentest you can generate a certificate next to the report. It is the short, shareable proof that a pentest was done and what it found.

States

State	Meaning
In progress	The run is not finished, or its result does not meet the clean gate yet.
Attested	The pentest completed with no high or critical findings.

SQUR does not issue an attested certificate that the findings do not support.

The public verify page

Each certificate has a public verify page with a QR code. Anyone you give the link or QR code to, such as a customer, procurement team or auditor, can open it without an account and confirm the certificate is genuine and which scope it covers. The page shows only that certificate's data.

The certificate carries an integrity hash. If the underlying report changes, the verify page does not match and flags it.

Keeping it current

With continuous pentesting, a clean run refreshes the certificate, so the proof you show customers is weeks old and not a year old. A new or regressed finding triggers an alert instead.

Certificate versus report

	Certificate	Report
Audience	Customers, procurement, auditors	Security team, developers
Content	Scope, date, result	Findings, evidence, remediation
Shareable publicly	Yes, through the verify link	No, treat as confidential

See Customer report documents for the report variants.