FAQ and troubleshooting

Signing in

I cannot sign in. Check your email and password. Five failed attempts lock the account for 15 minutes. If you see “deactivated”, ask your Client Administrator or TrekShield contact. An invitation link older than 7 days must be resent.

My authenticator code is rejected. Check that your phone’s clock is set automatically, then try the next code. A single-use recovery code also works.

I forgot my password or lost my authenticator. There is no self-service reset screen. Contact your Client Administrator or your TrekShield engagement manager.

I was signed out. The app signs you out after 30 minutes idle.

What I can see

There are no findings. Findings appear only after the engagement is delivered. Client Users see engagements they belong to, and Client Developers see findings assigned to them.

I cannot see a report. You see a report only once an engagement manager has published it. Download links last about five minutes; select Download again.

I cannot create an engagement. TrekShield engagement managers create them; ask yours.

Working with findings

Accept Risk asks for an approval. Critical and high findings need approval from a TrekShield engagement manager. Give a justification of at least 50 characters (details).

There is no Request Retest button. Only Client Administrators can request one. The finding must be In remediation, or select findings on the engagement’s Findings tab, and the engagement must be delivered, completed or on hold (retests).

The due date differs from the SLA table. The person who assigned the remediation chooses the date, and the dialog pre-fills seven days (SLA).

Invitations

An invitation fails. Common causes: the role is not below yours, the engagement is not yet Scheduled, an invitation or account already exists for that email, the domain is disposable, or you have sent 10 invitations this hour (team and roles).

Integrations and API

My webhook receives nothing. Check that the URL is public HTTPS, that it returns 2xx within 10 seconds, and that the webhook is active. Events are tried once, so review the delivery history (webhooks).

Signature verification fails. Hash the exact raw body, not re-serialized JSON, and use the secret from creation or the latest rotation.

Jira or ServiceNow did not create a ticket. Tickets are created when a finding is triaged, only if the integration is enabled and the organization has a single client (integrations).

The API returns 401. The key is mistyped, expired or revoked, or its owner was deactivated (API keys).

The API returns 403. Your role does not allow that action; the same rule applies in the web app.

Still stuck?

Contact your engagement manager.