Security posture, mapped to the OWASP Top 10

Every run already checks the headers, cookies and responses of the pages it visits. The new Security view on Trends turns those checks into a record over time, so you can see what is still open, what got fixed and how long it took.

• One issue per check per site. An issue opens on the first run that reports it. It closes on the first later run of the same site that finished, loaded the page or file named in the evidence (for a served source map, a script from the host that served it), and no longer reports it. Runs that errored, timed out or were stopped never close anything, and an issue that comes back after a fix counts as a new one.
• Pull requests by repository. Pull request runs test a new preview address each time, so their issues are grouped by repository instead of by address. An issue on a site no run has checked for 30 days drops out of the open count, and the view says how many.
• Four numbers against the period before. Open issues, critical and high, fixed, and the mean time to fix from first seen to the run that no longer saw it.
• Open issues by severity, week by week. What was still open at the end of each week.
• OWASP Top 10:2025. All ten categories with the open, opened and fixed counts and the checks behind them. Each check cites a CWE that OWASP lists under its category. Missing headers are filed under Security Misconfiguration by the category text and cite CWE-16, Configuration.
• The evidence with each issue. The pages, headers or cookies the latest run saw, and a link to that run. Fixed issues link to the run that fixed them.
• CSV or PDF. A CSV of each table, and one PDF with the numbers, the OWASP table, open issues with their evidence and the fixes in the period.

Security findings the agent writes on its own are tracked too, in a Not mapped row. The mapping is ours, not a certification.