Proof status
Severity alone does not tell you how hard the claim was proven. Every finding carries a proof_status so the UI, API, and reports never look like a mystery scanner dump.
Taxonomy
| Status | Label | Meaning |
|---|---|---|
exploit_confirmed |
Exploit confirmed | Strongest bar — active exploitation, EDB replay, or post-exploit harvest demonstrated impact |
verified |
Verified | Accuracy Gate (or hard in-scan signal) independently reproduced the claim |
presence |
Presence-based | Detection is the proof (missing header, open port, TLS misconfig, GraphQL introspection on, …) |
version_only |
Version-only (exploitability unknown) | Product/version ↔ CVE match without a successful exploit attempt |
replay_failed |
Replay failed | Detector claimed HIGH/CRITICAL but external replay did not reproduce; demoted, curl proof stripped |
unverified |
Unverified | No gate ran / no verifier / typically below HIGH |
Qualitative confidence chips map from proof status:
| Proof status | Confidence |
|---|---|
| exploit_confirmed, verified | confirmed |
| presence | high |
| version_only | medium |
| replay_failed | low |
| unverified | tentative |
Rules the engine enforces
- A finding never stays
verified=truewithoutproof_statusin{verified, exploit_confirmed}. - Version-only findings never keep a verified badge; exploitability is labelled unknown.
- Classes that require exploit proof (SQLi, RCE, XSS, SSRF, IDOR, …) cannot ship as HIGH/CRITICAL without independent proof — they are fail-closed to MEDIUM if proof is missing.
- Presence-based types (security headers, banners, open ports) correctly use
presenceinstead of pretending a replay PoC exists.
How this differs from the Accuracy Gate
- The Accuracy Gate decides whether a candidate is junk and whether a second-pass verifier confirmed it.
- Proof status is the durable classification stamped on every shipped finding for operators, reports, and API consumers.
Filter or sort by proof_status in the findings API when you only want confirmed exploits or want to exclude version-only noise from sprint triage.
Reports and API
- HTML/PDF/DOCX reports show a human-readable proof chip next to severity.
- Findings API fields:
proof_status,confidence(and filters where supported). - Example filter mindset: “show me only
exploit_confirmed+verifiedHIGH+ for this sprint.”
See also
- Validation — junk filter + verifiers + AI FP filter
- Severity scale
- Reading results