Findings and evidence
Read findings, download proof-of-exploit evidence, discuss with testers, export lists, and request risk acceptance with the right justification.
Findings appear under Findings once the engagement is delivered. The list can be filtered by severity, status and text. To export, use the export menu to download the current view, or only the rows you select, as CSV, JSON or PDF. Client Users do not have export.
Reading a finding
Open a finding to see its tabs:
| Tab | Contents |
|---|---|
| Details | Description, impact, affected locations, steps to reproduce, proof of concept |
| Evidence | Screenshots and files that prove the issue |
| Remediation | Guidance and any assigned fix work |
| CVSS Calculator | The base metrics behind the score (how scoring works) |
| Related | Linked duplicates, variants and root causes |
| Timeline | Every state change, who made it and when |
| Validation Receipt | How the finding was confirmed, and by whom |
| Discussion | Comments with the TrekShield team |
Client Developers do not see the Discussion tab. Export PDF at the top of a finding prints a single-finding summary through your browser.
Evidence
Evidence is attached by TrekShield testers; customer roles can view and download it but not upload or delete it. Supported types are PNG, JPEG, GIF, PDF, TXT, CSV, JSON, XML, LOG, ZIP, DOCX and XLSX, up to 50 MB each. On upload the server checks that the file content matches its type, and records and verifies a SHA-256 hash.
Download links are short-lived, valid for about five minutes. If one expires, select Download again.
TrekShield does not run antivirus scanning on uploaded files, so open downloaded evidence with the same care you would any file from outside your network.
Comments
Discussion comments support @mentions. Comments the TrekShield team marks internal are never shown to you.
Request risk acceptance
If you decide not to fix a finding, a Client Administrator can select Accept Risk.
- Enter a justification of at least 50 characters. You can add an expiry date; it is written into the justification and does not reopen the finding on its own.
- Medium, low and info, while Reported: the risk is accepted immediately. Once a remediation exists, accept the risk on the remediation instead (guide).
- Critical and high: this sends an approval request. A TrekShield engagement manager approves or denies it and cannot approve their own request. A denial, with a reason of at least 10 characters, returns the finding to its earlier state. Requests are listed on your dashboard.
TrekShield engagement managers can reopen an accepted finding for remediation. Every step is recorded on the Timeline.
Next: assign and track fixes in remediations and retests.
Last updated: 2026-10-18