> ## Documentation Index > Fetch the complete documentation index at: https://docs.tolmo.com/llms.txt > Use this file to discover all available pages before exploring further. # Understand a finding > Read a Tolmo finding: what happened, why it is important, the evidence, and the fix. Learn what severity, triage status, and exploitability mean. A Tolmo finding is a vulnerability with its proof. The first part of a finding gives you the information to decide and act. The full technical record is below it, for the engineer who reproduces the issue. ## The first part of a finding A finding starts with four sections, in this order: | Section | What it tells you | | - | - | | **What happened** | What the agent did, and the result that it got. | | **Why it matters** | Who can do this, and what they can get. | | **Evidence** | The request and the response that prove the issue. | | **Fix** | The change that closes the issue. | ![An opened finding: severity and title, the stage and affected endpoint, a Copy fix prompt button, then what happened, why it matters, key evidence as a request and response, and a recommended fix.](https://mintcdn.com/tolmo/kiwEv-e5yPkqiwY3/images/red-team-agent/finding-detail.png?fit=max\&auto=format\&n=kiwEv-e5yPkqiwY3\&q=85\&s=553a69da57e5492512d926f8adf0a922) An open critical finding: the status and the target, then what happened, why it matters, the evidence, and the fix. The affected target is below the title. The target is a full URL, or a method and a path such as `POST /api/auth/reset-password`. ## The full technical record The other sections are for the engineer who reproduces the issue or reviews the fix. | Section | What it contains | | - | - | | **Proof of concept** | The steps that exploit the issue. It often contains a script that you can run. | | **Reproduction script** | A script that reproduces the issue from a new session. | | **Request and response** | The full request and response, with headers, as the agent sent and received them. | | **Root cause** | Numbered steps from the entry point to the flaw. Each step points to the code. | | **Impact** | The effect outside the endpoint, with regulatory effects if they apply. | | **Fix** | The full change, with a test that prevents a regression. | ![The expanded technical detail of a finding: reproduction steps, the full request and response, technical context, impact, remediation detail, and the run that found it.](https://mintcdn.com/tolmo/kiwEv-e5yPkqiwY3/images/red-team-agent/finding-see-more.png?fit=max\&auto=format\&n=kiwEv-e5yPkqiwY3\&q=85\&s=b976cb1fbcfd6fabb08ca147410633f9) The technical record: reproduction, the full request and response, technical context, impact, and remediation. A section appears only when it has content. For example, if an app has no connected repository, its findings have no root cause in code. ### Chained findings Some low-severity issues share an asset. Together, these issues can make one attack with a higher severity. For example, an anonymous upload can lead to cache poisoning. Tolmo reports the chain as a separate finding. The chained finding links to each finding that it contains. ### Sources and duplicates Sometimes the Red team agent and a scanner report the same issue. Tolmo then keeps one finding and shows the two sources. Sometimes two findings still show the same issue. Tolmo then marks one finding as **Duplicate**, and that finding links to the other finding. ## Severity Each finding has one of these severities: **Critical**, **High**, **Medium**, **Low**, or **Info**. Lists of findings sort by severity. Findings from the Red team agent also have a CVSS v4.0 score. The agent calculates the score from the evidence that it recorded. ## Two statuses: triage and exploitability Each finding has two statuses, and each status changes independently. The triage status shows what your team decided. The exploitability shows what Tolmo proved. ### Triage status | Status | Meaning | | - | - | | **Open** | The finding needs a decision or a fix. | | **In review** | A fix is in progress. You can link the pull request. | | **Acknowledged** | Your team knows about the finding and decided not to act now. | | **Closed** | The issue is fixed, or the work is complete. | | **False positive** | The issue is not real. Add a reason, so the next person does not do the same work again. | If you connect Linear and someone cancels a ticket in Linear, Tolmo shows the finding as **Canceled**. To change the triage status, see [Fix a finding](https://docs.tolmo.com/pentesting/fix.md). ### Exploitability | Exploitability | Meaning | | - | - | | **Validated exploit** | An agent exploited the issue on your live authorized target. The agent kept the proof. | | **Not exploitable** | An agent tested the issue. The issue is not exploitable as reported. | | **Not validated** | No agent proved or disproved the issue yet. | | **Resolved** | The issue was exploitable. Then a retest showed that the exploit does not work now. | The exploitability changes only when an agent tests the finding. Sometimes the test does not get a clear result. Then the finding shows one of these states: | State | Meaning | | - | - | | **No permitted domain** | The target is outside your [authorized domains](https://docs.tolmo.com/pentesting/scope.md). | | **Defence in depth** | The issue is real, but the internet cannot reach it. Fix it too. | | **Could not produce an exploit** | The agent tried, but the exploit did not work. | ## Next steps > [card] [Fix a finding](https://docs.tolmo.com/pentesting/fix.md) > > Copy the fix prompt, link the pull request, or create a ticket. > [card] [Retest a fix](https://docs.tolmo.com/pentesting/retest.md) > > Prove that the exploit does not work now. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.