Reports

Two output formats

A structured Markdown report and a self-contained HTML report, both generated from the same underlying report data. See a real, generated example on the Reports page.

What a generated report contains

• Executive Summary — asset, service, and finding counts, with a severity breakdown.
• Scope — the allow/deny rules that were active for the run.
• Attack Surface / Asset Inventory.
• Services & Exposed Technologies.
• Findings — full detail per finding: category, confidence, verification status, discovery time.
• Exploit Intelligence — with an explicit disclaimer that a candidate match is not confirmation of exploitability.
• Evidence — raw and parsed, safely rendered.
• Technical Appendix — tools used and artifact paths referenced.

A dedicated Methodology section, a Recommendations section, and embedded screenshots are not part of the generated report today — planned, not silently missing.

Security discipline in report generation

Every field in a report can contain attacker- or target-influenced text — an nmap banner, a nuclei match, a searchsploit title. Every such string is escaped at the point it’s written into the output: HTML-escaped for the HTML renderer, and for Markdown, both Markdown-structural characters and raw HTML entities are escaped, since most Markdown renderers pass embedded HTML straight through. Evidence blocks use a dynamically-chosen code-fence delimiter specifically to prevent hostile content from breaking out of its fence.

Artifact paths are shown as plain, escaped text — never as clickable file:// links, and never inlined as images. Empty or partial results are represented honestly (a section explicitly says “no findings were identified” rather than being omitted), matching how the rest of Hollowpath treats incomplete data.

Planned: a review pass before export

A dedicated Review Findings workflow — where an analyst validates, classifies, and annotates findings before final export — is on the roadmap, not yet built.