Evidence Capture, Export, and Reproducibility
Overview
Every finding an agent files carries the raw material behind it — the request that triggered it, the response that proved it, a screenshot, or the command that surfaced it.
This article covers what gets captured, how the agent records it, how those recorded artifacts are reused to reproduce and validate a finding later, and how to export evidence out of the platform.
1. Evidence Types
A finding can carry several kinds of evidence, each attached to the finding record itself.
Evidence Type | What It Proves |
|---|---|
Screenshot | Visual state at the moment the finding was observed |
Request/Response Pair | The exact HTTP exchange that produced the result |
HAR File | A full recorded browser session leading to the finding |
Exploit Script | The exact steps used to trigger the vulnerability |
Command Output | The exact command run and what it returned |
2. How the Agent Records Evidence
Evidence is captured at the moment the agent does the work that produces it, not reconstructed afterward.
When an agent files a finding, it attaches the supporting file — a screenshot, a saved request/response transcript, a HAR, or a script — directly to that finding, and a reference to it is embedded inline in the finding’s own description so the evidence renders in place on the finding page and in every generated report.
Findings from automated testing additionally carry the request and response as structured fields on the finding record itself. Separately, the full session of a workspace chat — every command the agent ran and what it returned — is preserved as part of that chat’s history for as long as the workspace exists.
3. Reusing Recorded Artifacts to Reproduce and Validate Findings
Because the exact artifact behind a finding is preserved rather than summarized, that same artifact can be replayed to check whether the finding still holds.
A stored request/response pair can be resent against the same target to confirm the vulnerability is still present. A recorded command can be re-run the same way to confirm the same result. A screenshot gives a fixed point of comparison even if the live system has since changed.
This applies whether the person reproducing the finding is the client’s own team, an auditor, or the agent itself on a later run against the same target.
4. Exporting Evidence
Evidence Type | Where It Lives | Exportable As |
|---|---|---|
Screenshots, HARs, Exploit Scripts | Attached to the specific finding | Individually, per finding; embedded in generated reports |
Request/Response Pairs | Stored on the finding record | Individually, per finding; embedded in generated reports |
Commands and Their Text Output | The workspace chat session | As a single Markdown file per chat |
A workspace chat’s full session can be exported as a single Markdown file directly from the chat, including every command run and its text output.
Individual evidence attachments can be downloaded one at a time from the finding they are attached to.
5. Current Limitations
There is no single bulk export of all raw evidence for an engagement — one action producing every screenshot, every request/response pair, and every command run across a workspace in one bundle.
Evidence today is either attached to the specific finding it supports, viewed or downloaded one at a time, or captured in a chat’s Markdown export, which is text only and does not include screenshots or binary attachments.
Summary
- Findings carry attached screenshots, request/response pairs, HARs, exploit scripts, and command output as first-class evidence.
- Evidence is captured by the agent at the time it does the work, not written up afterward.
- The same recorded artifacts can be replayed to reproduce and validate a finding later.
- Evidence exports individually per finding, or as a full chat transcript in Markdown.
- A single bulk export across an entire engagement is not yet available.