Findings & Reports
Confirmed issues collect in the XHack Vulnerabilities panel as full findings you can search, revisit, and export as JSON, Markdown, HTML, or a branded PDF report.
Documentation
XHack AI Agent
- CoHunter Guide
- Sub-Agents
- HTTP Repeater
- Background Tasks
- Permission Modes
- Project Memory
- Plugins
- Mobile App Testing
- Findings & Reports
- Web Console
- Turn On the Web Console
- Run the Web Console on a Server
- Install the Console as an App
- Remote Access
- Turn On Remote Access from the Desktop App
- Deploy Remote Access on a VPS
- Approve a Device
- Manage Your Devices
- Remote Access Security Tips
- Remote Access Troubleshooting
- Bug-Bounty Hunting
- Programs
- Run Recon and See What's New
- Background Monitoring
- Start a Full Hunt
- Start a Hunt from an Empty Chat
- Questions from the AI
- Go Full Mode
- Collaborator
- Role Profiles and Access Matrix
- Desktop and Web Console in Sync
Findings & Reports
When the XHack Agent confirms an issue, it does not just mention it in chat. It files a full entry in the Vulnerabilities panel. Everything you need to understand, prove, and fix the issue lives in one place, and you can export the whole set as a report when you are done.
Verified before they are logged
The Agent reproduces every finding before it records it. A finding only lands in the panel once the Agent has shown it happens again, so you spend less time chasing false positives.
Open the Vulnerabilities panel
- In the bottom status bar, click Vulns (or press Ctrl+Shift+V).
- A findings list opens.
- Click any entry to open its full report.
What's in an entry
Each entry is a complete write-up, not a one-liner:
- Severity and type
- Location and the affected parameter
- Impact, why it matters
- Proof and step-by-step reproduction
- Recommended fix
- The HTTP request involved
- Screenshots
Entries are searchable, so you can filter a long list down to what you need, and they are persistent. They stay put across sessions and restarts.
Export a report
At the top of the Vulnerabilities panel:
- Export the set as JSON, Markdown, or HTML.
- Click Report to generate a branded PDF, a polished, client-ready document.
Pick JSON to feed another tool, Markdown or HTML to drop into your own docs, or the PDF Report to hand straight to a stakeholder.
Ready-to-submit bug-bounty reports
The Agent can write a finding up as a report ready to submit to HackerOne or Bugcrowd.
- Web console: open a finding and click Report.
- Desktop app: use Export in the findings view.
Read the report through before you submit it. The Agent writes it, but you are the one submitting it.
Related
- HTTP Repeater, confirm an issue, then it lands here
- Role profiles and access matrix, find IDOR and broken access control
- Collaborator, find blind, out-of-band bugs
- Start a full hunt, hand a whole bug-bounty program to the Agent
- Autonomous Pentesting, how issues are discovered
- Prompting Guide, ask the Agent to document an issue fully
Try XHack AI Now
Experience the full power of XHack directly in your browser. No installation required.
Launch XHack AI