Findings, Results, and reports

Hunt Web presents assessment output through three connected views. Findings collects verified issues across accessible scans. Results shows the saved findings and investigation records for one Run. Report presents a saved assessment snapshot for review and export. Understanding these views helps distinguish confirmed evidence, unfinished testing, and the exact assessment version included in a downloaded PDF.

1. Understand What Each Result Means

A suspected weakness passes through investigation and verification before it becomes a verified Finding. A request, tool response, or confident chat summary does not by itself establish a vulnerability.

1. 1CandidateA potential issue under investigation.
2. 2Submitted proofEvidence is submitted. Submission alone is not acceptance.
3. 3Verified FindingPassed automated verification and saved as an accepted result.

2. Review Findings and Their Evidence

Open Findings to inspect verified issues from accessible Runs. Search by finding text, Target, or endpoint, then narrow the list with the severity, Target, and Run filters. The severity summary helps prioritize review; each row identifies the finding, severity, Target/Scope, and source scan.

The list updates as saved findings become available, including those from Hermes continuations. Refresh requests an updated readout while the selected filters remain applied. Check the last-checked time and any notice about unavailable results or older report snapshots.

Enlarge

Select Open finding to examine the saved record:

CWE and CVSS appear when recorded. These fields describe the saved finding; they should be assessed alongside the application's actual deployment and business impact. The saved finding's title, classification, severity, description, and impact follow the independent verifier's structured assessment; see What's new.

Enlarge

Use View evidence for this finding to jump to the evidence section. Saved request / response provides a limited exchange preview, including the method, URL, response status, and partial-capture indicator where available. Private headers, URL values, and response bodies are omitted from that preview. Some findings rely on Browser or other evidence instead of a saved HTTP exchange. Opening saved PoC code displays it without executing it.

The list's Export control downloads JSON for the selected view. The assessment PDF is downloaded from the Run's Report tab. If the list reports incomplete data, refresh or inspect the affected Run; unavailable records should not be interpreted as a confirmed zero.

3. Inspect the Full Result State of One Run

Open Runs → the selected Run → Results. Its summary separates Verified Findings, Unfinished checks, and Awaiting verification. The table initially emphasizes verified findings. Use Result types to inspect candidates, submitted proofs, verification decisions, and other available records; search and status filters can narrow the view further.

1. 1RunsOpen the list of saved scans.
2. 2The selected RunChoose the assessment to inspect.
3. 3ResultsVerified Findings, unfinished checks, and items awaiting verification.

This distinction matters during an active assessment. Several submissions or verification decisions may relate to the same issue, so the number of result records is not the number of unique vulnerabilities. Review the saved Finding identities and outcomes before counting new findings.

Results combines the latest readable verification activity with saved coverage information. A report may not yet exist even though current findings are visible. In that case, unfinished checks become available after the scan saves its coverage results.

If current results cannot be read, the page can show findings from a saved report and identify that fallback. Read the warning and snapshot time before treating those records as current. Unavailable is a data-reading state, not a finding count.

4. Read the Report as a Saved Snapshot

Open the same Run's Report tab to review its saved assessment. The page shows the Target and Scope, testing method, profile, time limit, status when saved, and Report saved time. It also presents severity counts, testing boundaries, assessment coverage, and unfinished checks where available.

The report can contain verified findings from both the initial profile scan and subsequent Hermes work on that Run. A new finding becomes part of the report after an updated assessment snapshot is saved.

Check the Saved report snapshot notice when present. It may indicate newer activity, unconfirmed freshness, or verification that was incomplete when the report was saved. Use Open Run results to inspect newer data. Refresh report reads the saved report again; it does not run new tests or force pending candidates to become verified findings.

The two PDF timestamps answer different questions:

• Report saved: when the underlying assessment snapshot was saved.
• PDF exported: when a PDF was generated from that snapshot.

A recent export time can therefore accompany an older assessment. Reopening Report and downloading again includes newer findings only when a newer snapshot is available. Findings saved before an update are not automatically rewritten or reassessed.

5. Download the Assessment

1. 1Open the ReportRuns, then the intended assessment, then Report.
2. 2Check the saved versionScope, saved time, finding count, and coverage notices.
3. 3Refresh the reportIf newer results are expected, then review the saved version.
4. 4Download the PDFA formatted copy of that assessment.

1. Open Runs, select the intended assessment, and choose Report.
2. Check the Scope, saved time, finding count, and coverage notices.
3. Select Refresh report if newer results are expected, then review the saved version.
4. Select Download PDF to obtain a formatted copy of that assessment.

Download Markdown provides a text-based report, and Download JSON provides structured report data. PDF generation reads the saved assessment; downloading does not start or resume scanning.

If the saved report changes during a download attempt, refresh the page and try again. Report not available yet means that a report has not been saved; review the Run's progress and Results. If PDF export is temporarily unavailable, retry or use the available Markdown export.

Dashboard report downloads require login and permission to read the Run. Publishing a downloaded sample as a website file is a separate action. Review evidence narratives and request examples for session identifiers or other sensitive values before sharing an exported report publicly.

6. Explore the Sample PDF

The supplied sample contains 66 pages and 14 recorded verified findings from a Blackbox assessment using the Quick profile. These figures describe that saved example, not expected output for every Target or a measurement of scanner detection accuracy. The screenshots above show a different workspace view and should not be used to reconcile the sample's finding count.

The cover identifies the assessment and its timestamps. The linked Contents on page 2 provides navigation to report sections and individual findings.

For a representative finding layout, pages 7-10 show how a longer record continues across pages while retaining its finding reference and section labels. This layout connects the finding description with the evidence and recommended remediation; it is not a complete raw traffic archive.

The sample also illustrates the distinction between execution and coverage: Time limit reached describes the Run's status at the snapshot, while Assessment incomplete describes its recorded assessment coverage. A Run's status does not establish complete testing of every feature.

The SHA-256 values in Report reference identify saved source artifacts. They are not digital signatures or checksums of the downloaded PDF itself. Use the Run reference and saved time to associate the document with the correct assessment version.

7. Use Findings for Human Review and Follow-Up

Section 5 explains that AI agents and automated tools can misinterpret behavior, misjudge impact or severity, and miss vulnerabilities. Verified means the finding passed Hunt Web's automated verification. Human review remains necessary before relying on the result for remediation decisions.

A practical review starts with the recorded Scope and account conditions, then follows the highest-priority findings through their evidence and reproduction steps. Confirm the demonstrated impact, assess the proposed remediation, and track unfinished or inconclusive work separately.

For further investigation, open the same Run in Hermes Chat and reference the relevant finding, application feature, or unresolved check. The Hermes Chat and Templates guide explains how to read prior evidence and request a focused continuation. The broader Scanning Workflow guide covers assessment setup and the path from Target to Report.