> For the complete documentation index, see [llms.txt](https://docs.konvu.com/konvu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.konvu.com/konvu/triage-and-remediation/finding-types/vulnerability-reports.md). # Vulnerability Reports How Konvu triages, deduplicates, and reproduces bug bounty reports, pentests, scanner exports, and findings from AI code security tools. A vulnerability report is a finding that arrives as a document: a bug bounty submission, a pentest report, a scanner export, or the output of an AI code security tool. Unlike a scanner finding, it makes claims in prose that may be wrong, duplicated, or out of scope. Konvu checks each report against your program rules, links duplicates, and reproduces the rest. | | | | ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Sources** | [HackerOne](/konvu/get-started/bring-in-findings/bug-bounty-programs/hackerone.md), GitHub Security Advisories, [external reports](/konvu/get-started/bring-in-findings/external-reports.md) uploaded from the dashboard, the CLI, or the API | | **Where to find them** | **Triage > Vulnerability reports** | | **Triaged** | Yes, against your program rules | | **Reproduced** | Yes. See [Exploit Reproduction](/konvu/triage-and-remediation/exploit-reproduction.md). | | **Fix pull requests** | No. Konvu gives you a fix prompt for your coding agent. | ## How a report moves through Konvu | Stage | What happens | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **1. Split** | An upload that holds several findings, such as a scanner export, becomes one report per finding. See [External Reports](/konvu/get-started/bring-in-findings/external-reports.md#reports-with-many-findings). | | **2. Triage** | Konvu checks the report against your program's scope and rules. | | **3. Deduplicate** | Konvu links reports that describe the same vulnerability. Duplicates are grouped under the original report in the list. | | **4. Reproduce** | Valid, non-duplicate reports are reproduced in a sandbox. | When automation is set to reproduce, every stage runs on its own as reports arrive. Konvu configures this per organization. ## Programs Every report belongs to a **program**, which tells Konvu what is in scope: * **Platform**: HackerOne, Bugcrowd, Intigriti, YesWeHack, or custom. * **Program URL**: the public program page, which Konvu reads for scope and rules. Required for every platform except custom. * **Rules**: for a custom program, your scope and rules in Markdown. Konvu applies them when triaging. * **Open source**: whether the target is an open-source project. * **Repository targets**: the repositories the program covers, as `owner/repo`. ## Triage results | Result | Meaning | | -------------- | -------------------------------------------------------------------------------------------------------------- | | **Valid** | The report is in scope and describes a plausible vulnerability. It moves on to deduplication and reproduction. | | **Invalid** | The report is rejected, with a reason. | | **Needs info** | The report lacks something Konvu needs, such as the affected endpoint. You can still request a reproduction. | Invalid reports carry one of these reasons: **Out of Scope**, **Duplicate**, **Not a Vuln**, **Insufficient Info**, **Already Known**, **Informational**, **Not Reproducible**, **Won't Fix**, **Spam**, **Hardening**, **By Design**, **Not Applicable**, or **Injection Detected**. Once a report is reproduced, the reproduction result replaces the triage result: **Reproduced**, **False positive**, **Hardening**, or **Inconclusive**. See [Reading a Reproduction](/konvu/triage-and-remediation/exploit-reproduction/reading-a-reproduction.md). A report counts as **Fixed** only when a fix is confirmed. Reports closed as invalid or not exploitable stay **Open**, so a closed report is never mistaken for a patched one. The report list separates **Open**, **Fixed**, and **Dismissed** reports. ## Act on the results * **Fix a reproduced vulnerability.** The report's **Remediation** tab has Konvu's recommendations. **Copy fix** copies a prompt for your coding agent with the vulnerability, the proof, and the recommendations. Tokens, cookies, and keys from the evidence are redacted, and report content is marked as untrusted so your agent does not follow instructions hidden in it. * **Check the fix.** Reproduce the report on the latest version to confirm the exploit no longer fires. See [Re-running Reproductions](/konvu/triage-and-remediation/exploit-reproduction/re-running-reproductions.md#check-the-latest-version). * **Correct a wrong result.** Steer the report with what was wrong. See [Re-running Reproductions](/konvu/triage-and-remediation/exploit-reproduction/re-running-reproductions.md#steer-a-wrong-result). * **Dismiss a processed report.** Record why no more work is needed and, optionally, a ticket reference. You can reopen it later. ## Dismiss a processed report Open the report or its row action menu and select **Dismiss**. To close several reports, select their checkboxes in the **Open** list and click **Dismiss** in the bulk action bar. Choose a reason and, if useful, add a comment such as an internal ticket reference. Dismissal does not rate or change the assessment or its evidence. It records the reason, comment, actor, and time, then moves the report to the **Dismissed** tab. Select **Reopen** to return it to the active workflow; its assessment and feedback are kept. ### From the CLI ```bash konvu finding vulnerability-report dismiss \ --reason "Tracked externally" \ --comment "Handled in JIRA SEC-1234" konvu finding vulnerability-report reopen ``` Rating is a separate action. Use `konvu finding vulnerability-report rate` when you want to record assessment feedback; see the [CLI reference](/konvu/reference/cli.md#konvu-finding-vulnerability-report-rate). ## What Konvu does NOT do * It does not open fix pull requests for reports. * It does not reply to researchers or change report status on HackerOne. The integration is read-only. * It does not trust report content. Every stage checks for prompt injection. See [How Reproduction Works](/konvu/triage-and-remediation/exploit-reproduction/how-reproduction-works.md#reports-are-untrusted-input). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.konvu.com/konvu/triage-and-remediation/finding-types/vulnerability-reports.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.