Scanning & findings

Every request Studio sees — whether it came from an import, the proxy, Repeater, or an active probe — is captured as an exchange and can trigger a finding. This page covers where those show up and how to read them.

Passive vs. active rules

Studio ships a first-party rule pack, each rule tagged with OWASP API Top 10 (2023), OWASP Top 10 (2021), CWE, and optionally MITRE ATT&CK:

• Passive rules run automatically on every captured exchange — import, proxy traffic, Repeater replay. They only look at requests/responses you already generated; they never send anything extra.
• Active rules send a small number of additional, targeted requests (for example a safe canary probe) to confirm a hypothesis. They only run when you explicitly trigger them, and only against hosts covered by your scope rules.

Open Coverage to see the full rule pack as an honest matrix: which OWASP/CWE categories are covered, by which rule, passive or active. If something isn't covered, the matrix says so instead of implying blanket coverage.

Findings

The Findings view lists everything the rule pack has flagged for the current project: severity, confidence, the OWASP/CWE/MITRE tags, and structured evidence (the request/response that triggered it). Findings accumulate across every source — a quick scan, proxy traffic, an active-rule run, or a role-diff — so the list reflects everything you've tested so far, not just the last action.

From a finding you can jump straight to the underlying exchange to inspect it, or open it in Repeater to poke at it further.

When you're ready to hand results off, see Checklist & reporting for SARIF/JUnit/git-friendly export.

Sitemap and scope

Sitemap groups every captured exchange into a tree by host and path (numeric path segments like IDs are folded together so /users/12 and /users/13 land in one node instead of two). It's the fastest way to see what an API surface actually looks like once you've imported a spec or run some traffic through the proxy.

Scope rules decide which hosts Studio is allowed to actively touch — active rules, role-diff probes, and the proxy's own MITM behavior all respect scope. Add the hosts you own before running anything active; anything outside scope is left alone. You can toggle an individual exchange in or out of scope from the Sitemap view as well.