Manage findings¶
Every confirmed finding includes the proof SQUR captured, reproduction steps and a recommended fix. You can work with findings in two places:
- Findings (sidebar): the inbox across all your apps, with its history across every run.
- The run page: the findings of one pentest, read in full next to the list.
Find what matters¶
On Findings, search by name or ID (SQUR-...) and filter by severity (Critical, High, Medium, Low, Info), lifecycle (Open, Fixed, Regressed), re-test state (Never re-tested, Re-testing, Re-tested, Re-test failed) and assignee. Group by severity or asset. Columns lets you choose what the table shows: severity, finding, asset, first seen, endpoint, last re-tested, lifecycle, confidence and verdict.
Summary cards at the top count critical findings and findings still awaiting a first look.
Read a finding¶
Select a finding to open its details. You see what was found, where (endpoint and method), the evidence and screenshots, the fix guidance, and an autonomous fix when one exists (see Remediation). Three labels describe each finding:
| Label | Values | Meaning |
|---|---|---|
| Lifecycle | Open, Fixed, Regressed | Where the finding stands on the app. Regressed means a fixed finding came back. |
| Confidence | Confirmed, Unconfirmed, Inconclusive | How sure the agent is. Confirmed means it was exploited and verified. |
| Verdict | Accepted risk, False positive | Your decision, if you made one. |
Record a decision¶
Use the actions at the bottom of the details panel:
- Mark fixed after you ship a fix, then retest to verify.
- Accept risk when you knowingly live with it. Give a justification. In organizations with approval, this creates a proposal that an organization admin approves or rejects on the Proposals page.
- False positive if you believe it is not real. Give a reason.
- Re-open clears a decision.
Accepting risk and false-positive decisions belong to the owning organization.
Review history and comments¶
History lists when a finding was discovered, re-confirmed or re-verified across runs. Use Comments to discuss it with your team.
Duplicates¶
The same issue seen in several runs is merged into one finding. Open Linked findings to see the findings merged into it. Use the filter to include or hide merged duplicates and ruled-out findings.
Add a finding¶
Verified something yourself outside SQUR? Add a finding on the run page records it with its own evidence.