01
Evidence Room
See completed work by actual Git repository, URL, upload, or path and export the latest report for selected assets.
Security evidence and reporting
Make security work provable when someone asks.
Package current evidence by asset, export reviewed reports, share only the findings a recipient needs, and retain the decision history behind remediation, retest, and accepted risk.
Asset-level Evidence RoomPentest-style PDF exportsExpiring finding shares
PDFAuditor Reportcontrol evidence · current
PDFInternal Reportfindings · decisions · owners
PDFCustomer Reportcustomer-ready summary
hashedtimestampedshare-controlled
Capabilities
Evidence produced by the work itself
Reconstructing security history from tickets and chat during a customer review is expensive. The resulting story is usually incomplete.
02
Report and finding exports
Create Markdown, single-file HTML, or PDF outputs. Customer-facing PDFs default to aggregate severity context; include detailed finding evidence only for authorized recipients.
03
Controlled secure shares
Give a named recipient read-only access to selected findings through a password-protected, expiring, revocable link.
04
Disclosure tracking
Preserve reported, acknowledged, fixed, advisory, bounty, credit, and closure milestones for external issues.
05
Audit history
Show investigation stages, model resolution, human actors, outcomes, lifecycle changes, and reasons.
06
Branding and disclaimers
Apply account and tier settings to customer-facing reports without rewriting historical evidence.
How it runs
Build, select, review, deliver
How a report or an Evidence Room export is assembled from work that already happened.
Build
Create evidence continuously through projects, scan versions, finding states, tickets, and retests.
Select
Choose the exact assets, reports, sections, findings, and confidence boundary relevant to the request.
Review
Remove irrelevant or sensitive context and confirm important findings have current decisions.
Deliver
Export a static pack or use a time-bounded share, then revoke access when the review ends.
Outcomes
Answers ready before the question arrives
Faster assurance responses, with a smaller surface exposed to each recipient.
Faster assurance responses
Answer customer, audit, investor, insurance, and internal governance requests from current product history.
Smaller disclosure surface
Share selected findings instead of granting access to the workspace or sending the full internal report.
Defensible risk narratives
Connect the technical issue to validation, ownership, mitigation, and retest rather than presenting a static scan snapshot.
Evaluation FAQ
Questions about reports and the Evidence Room
What a PDF contains, what a recipient can see, and what this does not claim to prove.
Does the Evidence Room prove compliance?
No. It packages assessment evidence and history. Your organization still determines control scope, test frequency, reviewer requirements, and framework assertions.
Can a recipient see the rest of our scan?
A secure share exposes only the selected findings. It does not grant the recipient access to the rest of the report, project, or account.
What is included in a PDF report?
The default customer-facing PDF contains report context and aggregate severity counts without finding names or exploit details. An authorized operator can explicitly include detailed findings, evidence, branding, and disclaimers.
Related workflows
Customer reviews
Answer one real assurance request
Build a report from work you have already done and send it to a customer or auditor.