CSV Import and Findings

Overview

CSV import is how the tester on an expert-led penetration test brings a batch of findings into Fencer. Each row in the CSV becomes a vulnerability linked to the engagement and flows into the same vulnerability pipeline as automated scans, so your team can triage, assign, track, and report on pen test findings alongside all other vulnerability data.

Uploading results requires the Penetration Tester role. That role belongs to the Fencer security expert assigned to your engagement; it can’t be handed out from Admin > Team. A tester can also add a single finding with the Create button instead of a CSV.

CSV Column Reference

Required columns

Your CSV must include the following three columns. If any is missing, the upload is rejected with Missing required columns: ….

Column	Type	Description	Example
title	string	Short name of the vulnerability	SQL Injection in Login Form
severity	string	Severity level	critical, high, medium, low, or info
description	string	Detailed description of the finding	Attacker can bypass authentication...

Column names are case-sensitive: Title, SEVERITY, or Description are not recognized. Severity values are not case-sensitive (High and high both work), and informational is accepted as info.

The description identifies the finding: two rows with the same description are the same finding.

Optional columns

The following columns are accepted when present. Any other column name causes the upload to fail with CSV file contains unsupported columns: …, so remove custom headers before uploading.

Column	Type	Description
impact	string	Impact assessment
access_point	string	Access point or entry method used
user_profile	string	User profile or credential level used during testing
affected_target	string	Affected URL, endpoint, or system
cvss_score	decimal	CVSS score (e.g., 7.5)
poc	string	Proof-of-concept reproduction steps
remediation	string	Recommended remediation steps
cve_id	string	CVE identifier (e.g., CVE-2021-44228)
cwe_id	string	CWE identifier (e.g., CWE-89)
references	string	External reference URLs, separated by commas

A cve_id or cwe_id without its CVE- or CWE- prefix gets the prefix added.

Note

The upload dialog has a Download CSV Template button. The template includes every supported column with an example row to guide formatting.

Upload Flow

File requirements

• File type: the file name must end in .csv.
• Maximum file size: 5 MB.
• Encoding: UTF-8. Files with a BOM (utf-8-sig) are also accepted.
• Format: Standard comma-separated values with a header row and at least one data row. Quoted fields are supported for values that contain commas or newlines.
• Engagement state: the penetration test must have at least one asset and must not be Completed, Cancelled, or Failed.

Upload steps

1. Open the engagement under Posture > Penetration Testing.
2. Click Upload in the page header to open the Upload Vulnerabilities CSV dialog.
3. Select your CSV file and click Upload and Process CSV.
4. Fencer validates the file, imports every valid row, and reports the result.

Success confirmation

On a successful upload, Fencer shows Successfully created N vulnerabilities. Every imported finding starts in the Open status.

When at least one vulnerability is imported, organization admins are notified in the in-app inbox and by email by default. Other members can add a personal rule on Penetration test results uploaded.

Error reporting

Rows that fail validation are skipped, and Fencer shows a warning listing the first three errors, each with its line number (the header is line 1), followed by a count of the rest. Rows that pass validation are still imported.

Caution

Each upload is treated as the engagement’s complete set of findings. A row whose description matches an existing finding updates that finding instead of creating a duplicate, new rows create new findings, and findings from earlier uploads that are missing from the new file are marked Resolved. When you correct and re-upload a file, always upload the full list of findings, not only the corrected rows. To add one finding without affecting the others, use Create.

Adding and Editing Findings in the App

The tester can also manage findings one at a time, without a CSV:

• Add a finding — on the engagement, click Create in the page header. The Create Vulnerability form takes the same fields as the CSV: Title, Severity, Description, Impact / Risk Description, Remediation, Access Point, Affected Target, User Profile, CVSS Score, Proof of Concept, CVE ID, CWE ID, and references. Click Create vulnerability. Submitting a description that matches an existing finding updates that finding instead of creating another. Unlike a CSV upload, this never resolves other findings.
• Edit or delete a finding — open the finding and use Edit vulnerability (the pencil icon) to open the Edit Vulnerability form, or Delete vulnerability to remove it.

Editing and deleting are available only to the tester assigned to the engagement, and only until the engagement is Completed.

How Imported Findings Become Vulnerabilities

Each valid CSV row is imported as a vulnerability with:

• Source: the engagement’s penetration test scan.
• Status: Open.
• Severity: taken from the severity column.

The vulnerability flows into the same pipeline as automated scanner findings and also appears in your main vulnerability list.

Status Transitions and Role Restrictions

Findings on an expert-led engagement follow a verification workflow:

Status	Who can set it
Open	Administrator, Team Member, Penetration Tester
Ready for verification	Administrator, Team Member, Penetration Tester
Resolved	Penetration Tester only

Your team moves findings to Ready for verification to signal that a fix is in place. Only the tester can mark a finding Resolved, and only the tester can move a Resolved finding back to Open or Ready for verification. Read Only users can view findings but not change their status.

When no finding on the engagement is left open (each is resolved or ignored), the engagement moves from Ready for remediation to Completed.

Filtering and Sorting Imported Vulnerabilities

The engagement’s Vulnerabilities tab lists its findings with the columns Severity, Title, Status, First Seen, Assignee, and Linked Issue. It opens filtered to Status is Open. Use the filter bar to search and to filter by:

• Severity — Critical, High, Medium, Low, or Info.
• Status — Open, Ready for verification, Resolved, Ignored, or Deferred.
• Assignee — a specific team member, or No assignee.
• First Seen — a date range.

Click a column header to sort.

Bulk Actions on Imported Findings

Select one or more vulnerabilities and pick an action from the toolbar:

• Ignore / Unignore — suppress findings with an optional reason, or restore previously ignored items.
• Assign — assign the selected vulnerabilities to a team member.
• Mark Resolved — Penetration Tester role only.
• Mark Open — reset the selected vulnerabilities to Open.
• Ready for Verification — signal that the fix is ready for the tester to verify.
• Linear / Jira — create or link issues in a connected Linear or Jira workspace (shown only when that integration is connected).

To extend a bulk action beyond the current page, choose All (N) from the selection menu.

Examples

Well-formed CSV with required and optional columns:

title,severity,description,cvss_score,cwe_id,remediation
SQL Injection in Login Form,high,"SQL injection allows attackers to bypass authentication",8.8,CWE-89,Use parameterized queries and input validation
Cross-Site Scripting (XSS),medium,"Reflected XSS in search parameter",6.1,CWE-79,Sanitize input and encode output
Weak Password Policy,low,"Application permits weak passwords",3.1,CWE-521,Enforce minimum password complexity

Handling an upload error:

You upload a CSV and the warning includes: Error on line 4: Invalid severity 'Moderate'. Must be one of: CRITICAL, HIGH, MEDIUM, LOW, INFO

Moderate is not a supported severity. Change it to medium and upload the complete file again; the rows that were already imported are matched by description and updated rather than duplicated.

Troubleshooting

• “Missing required columns” error — confirm title, severity, and description are all present as column headers. Column names are case-sensitive and must be lowercase.
• “CSV file contains unsupported columns” error — remove any column headers not in the supported list. Custom fields are not permitted.
• “File size must be less than 5 MB.” error — split large finding sets across multiple CSV files. Because each upload replaces the engagement’s finding set, add the remaining findings with Create rather than a second partial upload.
• “Unable to decode CSV file” error — save your file with UTF-8 encoding. In Excel, use Save As and choose CSV UTF-8 (Comma delimited).
• “CSV file contains no data rows.” error — the file has a header row but no findings.
• Findings were marked Resolved after a re-upload — the new file left them out. Upload a file that contains every finding, or ask the tester to reopen them.
• The Upload button is missing — only the Penetration Tester role can upload, and only while the engagement is not Completed, Cancelled, or Failed.

Related pages

• Penetration Testing
• Vulnerability Management