From d89b958083e0e5f1bd51decd0fc5f38314528caf Mon Sep 17 00:00:00 2001 From: Paul Osinski Date: Fri, 11 Sep 2026 12:03:12 -0400 Subject: [PATCH] docs(connectors): document the YesWeHack severity fallback and status mapping The finding severity now falls back from the CVSS band to the triage priority and then to the numeric CVSS score, and every YesWeHack workflow state maps to an explicit finding status (RTFS lands as Out of Scope, duplicates as inactive duplicates). Spell both out on the tool page. Co-Authored-By: Claude Fable 5 --- .../content/connectors/toolreference/yeswehack.md | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/docs/content/connectors/toolreference/yeswehack.md b/docs/content/connectors/toolreference/yeswehack.md index 6146dd41191..e16097fd7c2 100644 --- a/docs/content/connectors/toolreference/yeswehack.md +++ b/docs/content/connectors/toolreference/yeswehack.md @@ -19,4 +19,17 @@ You will need a YesWeHack **Personal Access Token (PAT)**. Read access to your p 2. Enter your Personal Access Token in the **Secret** field. 3. Optionally, set a **Minimum Severity** to limit which findings are imported. Findings below the selected severity will not be imported. -DefectDojo creates a separate Record for each program your token can access, and imports each report as a finding. The finding's severity is taken from the report's CVSS rating (falling back to the triage priority), and its status reflects the report's workflow state — for example, resolved reports are imported as mitigated, and reports marked invalid or out of scope are imported as inactive. +DefectDojo creates a separate Record for each program your token can access, and imports each report as a finding. The finding's severity is taken from the report's CVSS rating, falling back to the triage priority, and then to the report's numeric CVSS score. + +The finding's status reflects the report's workflow state: + +| YesWeHack workflow state | Finding status | +|--------------------------|----------------| +| New, Under Review, Reopen Under Review, Need More Info | Active | +| Accepted, Ask for fix verification | Active, Verified | +| Resolved, Auto Close | Inactive, Mitigated | +| Won't Fix | Inactive, Risk Accepted | +| Invalid, Not Applicable, Spam | Inactive, False Positive | +| Duplicate | Inactive, Duplicate | +| Out Of Scope, RTFS | Inactive, Out of Scope | +| Informative | Inactive |