Work with findings

Fix, retest, accept the risk, discuss with your team and ask Zaaf, all from the finding's page.

Status actions

Action	What happens
Mark as fixed	Tells your team the fix is shipped. The finding stays open in Zaaf's eyes until a retest confirms it.
Request retest	Agents repeat the exact attack, and a researcher publishes the result. Fixed findings close as Fixed (verified); others return to Open.
Accept the risk	Records a decision not to fix, with a reason your team can read later. The finding leaves your open count and your reports.
Open GitHub issue	Files the finding in your connected repository. Needs a GitHub issues integration.

Comments are visible to your team and to Zaaf. Mention @Zaaf to ask the review team a question; a researcher replies in the same thread.

My notes holds one private note per finding. Only you can see it; Zaaf never sees your notes.

Every status and what moves a finding between them is listed in statuses.