2026-09-21 01:29 UTC
@valorin@phpc.social Ah, so in this context you're the one producing the report?
We have one provider who currently does automated testing & their platform stores the results/vulns; these can be collected as a single report or farmed out individual tickets if we give them a route to do so.
It's a little frustrating, because the individual vuln can benefit from things like the scope statement, which are only in the bigger document. And the devs don't have a way to get creds on the supplier's system easily.
Replies (1)
-
@yojimbo@masto.hackers.town 2026-09-21 01:32
@valorin@phpc.social I feel like this could be a client preference, rather than a supplier decision, which raises the engagement complexity of course. And management still like to have "reports" regardless of how the actual work is being performed. For my small $dayjob, I like findings to be separate tickets that Security can track the state of; but I would prefer to make the whole report available to any internal dev, because vulns might not be independent of each other, they get more context I hope.