2026-09-18 03:26 UTC
How does everyone feel about pentest findings/reports available online (behind auth), as opposed to emailed or sent via Slack/Teams?
I've always been wary of putting them online, even behind auth, but I can see some benefits - especially with agents doing the remediation work.
Replies (2)
-
@simon_w@cloudisland.nz 2026-09-18 06:07
@valorin@phpc.social I can see it being of use for multi-stage reports, where you can then highlight things that have been fixed / need further work more easily.
-
@yojimbo@masto.hackers.town 2026-09-20 20:35
@valorin@phpc.social From whom are they being protected? Who is the target audience for a report? I've seen places where "the report" goes only to Security, who then drip-feed demands for fixes to be performed around the business. I feel they'd like more restrictions. I'd prefer to dump the whole report on the technical people in one go, allowing the full "devsecops" response to find workarounds if they're quicker than fixes.