Vulnerability releasing
Last updated: Nov 4, 2026
The security analysts of Fluid Attacks report new weaknesses to the Fluid Attacks platform, or add new vulnerabilities to weaknesses that the platform already has. These weaknesses and vulnerabilities start in a draft status. With this status, only the Fluid Attacks staff with the applicable internal roles can get access to them.
Each draft gets an extensive peer review. The reviewers can make these types of observation:
- Writing: Corrections to spelling, grammar, clarity of the description, or additional vulnerability details
- Evidence: Supporting evidence to add or change
- Scoring: Issues with the CVSS score, for example, vector variables to examine again
- Consistency: Inconsistencies between elements, for example, a "Low" in the CVSS Privileges Required (PR) metric while the Threat details mention an "anonymous user" as a possible attacker
- Omission: Missing information
- Naming: A suggestion for the recategorization of the vulnerability under a different weakness
- False positive: The report is a false positive
- Duplicated: A report of the vulnerability already exists under another weakness
- Other: Reasons for rejection that are not in the categories above
When the observation is "Naming," "False positive," or "Duplicated," the draft status changes to "rejected," and the cycle ends. The pentester does not submit the draft again. With the other types of observation, the draft status also changes to "rejected." Then, the pentester who reported it must fix the draft and submit it again for a new validation cycle.
The reviewers check the vulnerability reports of pentesters until there are no more observations, with as many review cycles as necessary. When there are no more observations, the status of the reported vulnerability changes to "Open," and the client can see the vulnerability.