Reading Scan Results
Path: /scans/[id]
The scan detail page is where a run unfolds and where you interpret what was found. It updates live while the scan is running.
Progress & activity
- Stage progress - the two-stage pipeline (DAST → AI exploitation) with a percent bar.
- Activity log - real-time events (URLs discovered, attacks attempted, findings raised). Useful for understanding why a scan is taking time.
Attack Map
A visual map of the discovered surface: endpoints, parameters and the paths the scanner exercised. It shows where attacks landed and which routes were reached - the basis for the coverage score.
Findings & proof-of-exploit
Each finding row carries a severity, name, affected URL and source. Expand one to see:
- Evidence - the request/response pair that triggered the detection.
- Proof-of-exploit - for confirmed issues, the actual exploit interaction. When you see Exploit confirmed, apPosture proved it (not an AI guess) - this is the strongest signal for prioritisation.
- AI analysis - false-positive judgement, business impact, and a suggested fix.
- Remediation - concrete steps and references (CWE/OWASP).
App model
A structured model the engine built of the application (routes, parameters, auth state). Confirms what the scanner understood about the app - handy when results look thinner than expected.
Coverage panel
A quantified coverage score and grade with per-technique attribution: how much of the surface was crawled and tested, and honest caveats about what wasn't reached. Low coverage usually means auth wasn't working or scope was too narrow - fix those and re-scan rather than trusting a clean-looking result.
Report & export
Path: /scans/[id]/report
Generate a per-scan report (with compliance mapping) and export to PDF. For portfolio-level reporting see Reports.
Always check coverage before concluding "no issues." A 100% clean scan with 10% coverage tested almost nothing.