Reading a report
What the headline, the fix-first list, coverage and the finding detail each tell you, and the order to read them in.
A report is the state of one application at one moment, with the evidence that produced it. It is meant to be read top to bottom in about two minutes.
- 1The headline
One sentence and an outcome: no action required, action recommended, action required, or partial coverage. If the outcome is partial, read the coverage note before anything else.
- 2Fix first
The ranked list. Ranking uses severity, confidence, the domain the finding belongs to and what the Application Brain knows - a route holding personal data outranks one that does not.
- 3The finding detail
Each finding answers the same five questions and carries the rule id, the location and masked evidence.
- 4What the scan saw
The checks that ran and passed by area, then the facts behind them: DNS and mail records, indexing, AI crawler policy, how missing pages are handled, accessibility, third parties and delivery. A section that was not checked says so instead of showing zeros.
- 5Coverage
Which steps completed, which failed and which were skipped, with notes. This is how you know what the report is not telling you.
Outcomes
| Outcome | What it means |
|---|---|
| NO_ACTION_REQUIRED | Nothing was found that we would ask you to change today. |
| ACTION_RECOMMENDED | Findings exist, none of them are urgent. |
| ACTION_REQUIRED | At least one finding is serious enough to deal with now. |
| PARTIAL_COVERAGE | The scan could not finish. Treat the result as incomplete, not as clean. |
Every count in a report can be opened until you reach the request, file or header it came from. If something cannot be traced that way, it is a bug - tell us.
Questions
What does “partial coverage” mean?
One or more steps failed or were skipped, so the scan did not see everything it normally would. The report lists exactly which steps and why. A partial scan is never presented as a clean result.
Why is a finding ranked above a more severe one?
Ranking is not severity alone. Confidence, the domain and what we know about the application all count - a high-confidence high in a route that holds personal data can outrank a low-confidence critical somewhere harmless.
Something here wrong, missing or out of date? Tell us and we will fix the page.