Export reports, CVSS, and integrity-checked evidence

Prove the target boundary

Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.

GET http://127.0.0.1:5177/health

Complete report metadata

Add scope, methodology, WSHawk version, target fingerprint, timestamps, identities, limitations, and executive summary.

Score findings

Set CVSS vectors from exploit conditions and impact. Keep scanner confidence separate from severity and document every environmental assumption.

Export every format

Generate JSON, HTML, Markdown, PDF, CSV, and SARIF. Check that structured formats preserve stable finding IDs and evidence references.

Create an evidence bundle

Include sanitized raw requests, replay instructions, expiration state, screenshots where useful, hashes, and a manifest. Exclude encryption keys and raw secrets.

Verify integrity

Validate the manifest after copying the bundle to another folder. Any changed hash must fail verification and be investigated.