{
  "target": "https://app.example.com",
  "total_unique_findings": 7,
  "total_raw_findings": 10,
  "confirmed_by_multiple_tools": 2,
  "duration_seconds": 742.0,
  "findings": [
    {
      "tool": "sqlmap",
      "vulnerability_type": "SQL Injection",
      "severity": "critical",
      "url": "https://app.example.com/search",
      "owasp_category": "A03:2021 - Injection",
      "parameter": "q",
      "http_method": "GET",
      "confidence": "high",
      "cwe": "CWE-89",
      "found_by": [
        "sqlmap",
        "zap"
      ],
      "finding_id": "9c19fe1f-699d-4b4c-8785-80c23f3732c6",
      "evidence": "Demo data: boolean-based blind injection in the q parameter.",
      "validation_status": "needs-manual-validation"
    },
    {
      "tool": "zap",
      "vulnerability_type": "Cross Site Scripting (Reflected)",
      "severity": "high",
      "url": "https://app.example.com/profile",
      "owasp_category": "A03:2021 - Injection",
      "parameter": "name",
      "http_method": "GET",
      "confidence": "medium",
      "cwe": "CWE-79",
      "found_by": [
        "zap"
      ],
      "finding_id": "3fb3ded1-7509-4d79-b728-3e98ce6e3e3b",
      "evidence": "Demo data: the name parameter is reflected without encoding.",
      "validation_status": "needs-manual-validation"
    },
    {
      "tool": "nuclei",
      "vulnerability_type": "Exposed Configuration File",
      "severity": "high",
      "url": "https://app.example.com/config.bak",
      "owasp_category": "A05:2021 - Security Misconfiguration",
      "parameter": null,
      "http_method": "GET",
      "confidence": "high",
      "cwe": "CWE-538",
      "found_by": [
        "nuclei"
      ],
      "finding_id": "bbbf748b-1a8e-4eb4-87aa-10ba2590a9b7",
      "evidence": "Demo data: a backup configuration file is publicly readable.",
      "validation_status": "needs-manual-validation"
    },
    {
      "tool": "zap",
      "vulnerability_type": "Content Security Policy Header Not Set",
      "severity": "medium",
      "url": "https://app.example.com/",
      "owasp_category": "A05:2021 - Security Misconfiguration",
      "parameter": null,
      "http_method": "GET",
      "confidence": "high",
      "cwe": "CWE-693",
      "found_by": [
        "zap",
        "nikto"
      ],
      "finding_id": "60d0f681-e6c2-4e41-96ad-cb3caf9515d8",
      "evidence": "Demo data: the response has no Content-Security-Policy header.",
      "validation_status": "needs-manual-validation"
    },
    {
      "tool": "nikto",
      "vulnerability_type": "Outdated Server Software",
      "severity": "medium",
      "url": "https://app.example.com/",
      "owasp_category": "A06:2021 - Vulnerable and Outdated Components",
      "parameter": null,
      "http_method": "GET",
      "confidence": "medium",
      "cwe": "CWE-1104",
      "found_by": [
        "nikto"
      ],
      "finding_id": "73ac3d22-a6dc-418c-a79a-66f6a2c5aaff",
      "evidence": "Demo data: the Server header reports an old version.",
      "validation_status": "needs-manual-validation"
    },
    {
      "tool": "zap",
      "vulnerability_type": "Cookie Without Secure Flag",
      "severity": "low",
      "url": "https://app.example.com/login",
      "owasp_category": "A05:2021 - Security Misconfiguration",
      "parameter": null,
      "http_method": "GET",
      "confidence": "high",
      "cwe": "CWE-614",
      "found_by": [
        "zap"
      ],
      "finding_id": "ecdb0f0e-cb21-452a-b34b-0382a7356b7d",
      "evidence": "Demo data: the session cookie is set without the Secure flag.",
      "validation_status": "needs-manual-validation"
    },
    {
      "tool": "nikto",
      "vulnerability_type": "Server Version Disclosure",
      "severity": "info",
      "url": "https://app.example.com/",
      "owasp_category": "A05:2021 - Security Misconfiguration",
      "parameter": null,
      "http_method": "GET",
      "confidence": "medium",
      "cwe": "CWE-200",
      "found_by": [
        "nikto"
      ],
      "finding_id": "a6ce99d6-beeb-4a18-8e87-9c149b50f7a0",
      "evidence": "Demo data: the Server header discloses version details.",
      "validation_status": "needs-manual-validation"
    }
  ],
  "per_tool_counts": {
    "zap": 5,
    "sqlmap": 1,
    "nuclei": 1,
    "nikto": 3
  },
  "tool_runs": {
    "zap": {
      "status": "success",
      "duration_seconds": 300.0,
      "findings": 1
    },
    "sqlmap": {
      "status": "success",
      "duration_seconds": 300.0,
      "findings": 1
    },
    "nuclei": {
      "status": "success",
      "duration_seconds": 300.0,
      "findings": 1
    },
    "nikto": {
      "status": "success",
      "duration_seconds": 300.0,
      "findings": 1
    }
  },
  "severity_summary": {
    "critical": 1,
    "high": 2,
    "medium": 2,
    "low": 1,
    "info": 1
  },
  "owasp_summary": {
    "A03:2021 - Injection": 2,
    "A05:2021 - Security Misconfiguration": 4,
    "A06:2021 - Vulnerable and Outdated Components": 1
  }
}