Skip to main content
A Tolmo finding is a vulnerability with its proof. The first part of a finding gives you the information to decide and act. The full technical record is below it, for the engineer who reproduces the issue.

​
The first part of a finding

A finding starts with four sections, in this order:
An opened finding: severity and title, the stage and affected endpoint, a Copy fix prompt button, then what happened, why it matters, key evidence as a request and response, and a recommended fix.

An open critical finding: the status and the target, then what happened, why it matters, the evidence, and the fix.

The affected target is below the title. The target is a full URL, or a method and a path such as POST /api/auth/reset-password.

​
The full technical record

The other sections are for the engineer who reproduces the issue or reviews the fix.
The expanded technical detail of a finding: reproduction steps, the full request and response, technical context, impact, remediation detail, and the run that found it.

The technical record: reproduction, the full request and response, technical context, impact, and remediation.

A section appears only when it has content. For example, if an app has no connected repository, its findings have no root cause in code.

​
Chained findings

Some low-severity issues share an asset. Together, these issues can make one attack with a higher severity. For example, an anonymous upload can lead to cache poisoning. Tolmo reports the chain as a separate finding. The chained finding links to each finding that it contains.

​
Sources and duplicates

Sometimes the Red team agent and a scanner report the same issue. Tolmo then keeps one finding and shows the two sources. Sometimes two findings still show the same issue. Tolmo then marks one finding as Duplicate, and that finding links to the other finding.

​
Severity

Each finding has one of these severities: Critical, High, Medium, Low, or Info. Lists of findings sort by severity. Findings from the Red team agent also have a CVSS v4.0 score. The agent calculates the score from the evidence that it recorded.

​
Two statuses: triage and exploitability

Each finding has two statuses, and each status changes independently. The triage status shows what your team decided. The exploitability shows what Tolmo proved.

​
Triage status

If you connect Linear and someone cancels a ticket in Linear, Tolmo shows the finding as Canceled. To change the triage status, see Fix a finding.

​
Exploitability

The exploitability changes only when an agent tests the finding. Sometimes the test does not get a clear result. Then the finding shows one of these states:

​
Next steps

Fix a finding

Copy the fix prompt, link the pull request, or create a ticket.

Retest a fix

Prove that the exploit does not work now.