Findings

Every finding includes the affected asset, the exploit path the validator walked, the evidence it captured and an exploitability rating from 0 to 10.

Exploitability rating

• Reachability — whether the path is reachable from an untrusted position.
• Preconditions — authentication, configuration or timing the exploit needs.
• Impact — the data or value the replica allowed the attacker to reach.

Triage states

Findings move through Open, In repair, Fixed and Accepted risk. Accepting a risk requires a reason and an expiry date.