Pentestas / help

Proof status

Severity alone does not tell you how hard the claim was proven. Every finding carries a proof_status so the UI, API, and reports never look like a mystery scanner dump.

Taxonomy

Status Label Meaning
exploit_confirmed Exploit confirmed Strongest bar — active exploitation, EDB replay, or post-exploit harvest demonstrated impact
verified Verified Accuracy Gate (or hard in-scan signal) independently reproduced the claim
presence Presence-based Detection is the proof (missing header, open port, TLS misconfig, GraphQL introspection on, …)
version_only Version-only (exploitability unknown) Product/version ↔ CVE match without a successful exploit attempt
replay_failed Replay failed Detector claimed HIGH/CRITICAL but external replay did not reproduce; demoted, curl proof stripped
unverified Unverified No gate ran / no verifier / typically below HIGH

Qualitative confidence chips map from proof status:

Proof status Confidence
exploit_confirmed, verified confirmed
presence high
version_only medium
replay_failed low
unverified tentative

Rules the engine enforces

  1. A finding never stays verified=true without proof_status in {verified, exploit_confirmed}.
  2. Version-only findings never keep a verified badge; exploitability is labelled unknown.
  3. Classes that require exploit proof (SQLi, RCE, XSS, SSRF, IDOR, …) cannot ship as HIGH/CRITICAL without independent proof — they are fail-closed to MEDIUM if proof is missing.
  4. Presence-based types (security headers, banners, open ports) correctly use presence instead of pretending a replay PoC exists.

How this differs from the Accuracy Gate

  • The Accuracy Gate decides whether a candidate is junk and whether a second-pass verifier confirmed it.
  • Proof status is the durable classification stamped on every shipped finding for operators, reports, and API consumers.

Filter or sort by proof_status in the findings API when you only want confirmed exploits or want to exclude version-only noise from sprint triage.

Reports and API

  • HTML/PDF/DOCX reports show a human-readable proof chip next to severity.
  • Findings API fields: proof_status, confidence (and filters where supported).
  • Example filter mindset: “show me only exploit_confirmed + verified HIGH+ for this sprint.”

See also