Reports and Findings
The Reports tab lists every assessment your organization has run, in progress or complete, with what it found and how to get it out of Codity.
Following a run
A run moves through queued → running → completed. It starts queued because
a scan may wait for a slot before it begins; the tab refreshes itself every ten
seconds while a scan is in flight, so the status and the severity counts update
without you reloading anything. You can close the page and come back; the
assessment runs to completion regardless.
Two outcomes are worth knowing about:
- Failed. The reason is shown on the row. A run that could not reach the target fails rather than reporting a clean result — an unreachable application is never filed as a secure one.
- Partial. An active scan that reaches its time budget stops there. What it had already proven is kept and reported, and the run is recorded as partial, so a short report is never mistaken for a complete assessment.
Reading a finding
Expand a completed run to see its findings, ordered by severity. Each one carries:
| Field | What it tells you |
|---|---|
| Title and severity | What the issue is and how urgent it is |
| CVSS 3.1 score and vector | The standard score, with the vector so your own team can re-score it against your context |
| CWE | The weakness class, for tracking and for mapping to your own controls |
| Endpoint, method, parameter | Exactly where it is |
| Description | What the weakness is and why it matters here |
| Evidence | The request that was sent and the response that came back |
| Proof of concept | A reproduction step you can run yourself |
| Remediation | What to change to fix it |
| Verification | When the finding was first observed and when it was last checked |
Severities follow the usual scale:
- Critical — exploitable now, with severe impact. Fix immediately.
- High — serious and realistically exploitable. Fix in the current cycle.
- Medium — exploitable under some conditions, or serious only in combination. Schedule it.
- Low — hardening and best practice. Backlog.
A finding reaches the report one of two ways, and the difference is worth understanding. Something the scanner observed — a missing header, a cookie flag, a disclosed value — is proven by the response itself, so it is reported as observed. Something the scanner attacked is a judgement about exploitability, so it is validated against its own captured request and response first, and discarded if the evidence does not support it. Nothing unproven is carried into the report to pad it out.
The PDF report
Once a run completes, download the full report as a PDF. It is written to be handed to someone outside your engineering team — a customer's security reviewer, an auditor, or a procurement questionnaire — and contains:
- A confidential cover page with your organization, the domain or target, the assessment type, and the dates
- An overall risk grade and executive severity breakdown
- A scope statement saying what was assessed, under whose authorization, and where the boundary was drawn
- Every finding in full: description, CVSS score and vector, CWE, evidence, reproduction steps, impact, remediation, and first-observed / last-checked dates
- Findings from the previous report that are no longer observed
- For black-box scans: the email security grade with the SPF, DMARC and DKIM detail, the public attack-surface inventory, infrastructure providers, network registration records, and evidence-backed technology observations
- A statement of the methodology's limitations
- A risk-grade appendix, page numbering and a confidentiality footer throughout
An example report is available from the Pentesting page if you want to see the format before running an assessment.
Risk grade
The report's grade summarizes the findings observed in that run, weighted by severity, on a 0–100 scale:
| Score | Grade | Assessment |
|---|---|---|
| 0–10 | A | Low observed risk |
| 11–25 | B | Moderate observed risk |
| 26–45 | C | Material observed risk |
| 46–70 | D | High observed risk |
| 71–100 | F | Critical observed risk |
Critical findings dominate the score, then high, then medium, then low. A single critical finding is enough to move a domain out of the top grades, which is deliberate.
infoThe grade describes what this assessment observed. It is a measure of what was found, not a guarantee that nothing else exists.
Comparing against your last assessment
When you download a report for a target you have assessed before, Codity compares it against the previous completed report for the same target and lists the findings that were present then and are not present now.
How that list is labelled depends on whether the two runs are comparable:
- Same scan mode both times. The section is headed Resolved Since Previous Scan and the findings are reported as fixed or not observed. This is what turns a one-off report into a trend: you can show a reviewer not only what is open, but what you have closed since last time.
- A different scan mode this time. The section is headed Not Observed In This Scan, and the report says plainly that coverage differed and that you should re-scan in the previous mode to confirm closure. A finding absent from a shallower scan was not necessarily fixed — it may simply not have been looked for, and it is excluded from the fixed count for that reason.
JSON export
Every run can also be exported as JSON, containing the run metadata and the complete set of findings. Use it to load findings into your own tracker, your SIEM, or a compliance system. The JSON carries the full data, including inventory detail that the human-readable PDF abbreviates.
Retention
Reports are kept until you delete them. Deleting a report removes its findings and makes it unavailable for future comparison, so keep at least the most recent completed report for each target.
