Findings Review Comments

[valrdclr]

Hi, I was curious if there is any review feature for findings. So basically you can have typos/mistakes in your findings of course, and if the pentest lead or anybody else has to review them, then it has to be done separately (perhaps by downloading the pdf as a draft and leave comments there). Adding something to markdown is also not a good choice as it can mess it up or cause leftovers.

[MWedl]

Hi, you could prefix comments in markdown with "TODO". TODOs are highlighted in red in the markdown editor so you can quickly locate them in long texts. Additonally, TODOs generate warning messages. This helps in detecting leftovers in the report. Warning messages are shown on the publish page before generating the final PDF.

Adding a fully fledged commenting system is technically quite challenging. Commenting fields as a whole is quite easy, but attaching comments to words of text parts (like in MS Word, Google Docs, etc.) is complex. We need to track changes and update comments positions. However, without being able to attach comments to text parts, commenting markdown is not convenient. Especially for long texts.

[MWedl]

Implemented in https://github.com/Syslifters/sysreptor/releases/tag/2024.55 (Pro only)