2026-09-21 01:32 UTC
@valorin@phpc.social I feel like this could be a client preference, rather than a supplier decision, which raises the engagement complexity of course.
And management still like to have "reports" regardless of how the actual work is being performed.
For my small $dayjob, I like findings to be separate tickets that Security can track the state of; but I would prefer to make the whole report available to any internal dev, because vulns might not be independent of each other, they get more context I hope.
Replies (1)
-
@valorin@phpc.social 2026-09-22 23:55
@yojimbo@masto.hackers.town Yeah, the PDF reports will never go away, so much of the compliance ecosystem relies on them and they make a good completion-artifact. > I feel like this could be a client preference, rather than a supplier decision, which raises the engagement complexity of course. This is a good point. It wouldn't be overly hard to do a split system, online for the clients who want it. 🤔 I recently provided .md finding files to a client, who loved them for importing & processing.