> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mindfort.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Validate possible findings

> Submit a possible security issue to MindFort Validator, which tests it against your live target and adds it to Findings only if it reproduces.

## Overview

Validator checks whether a reported security issue is real. You describe the issue, and MindFort independently tests it against your live target. If the issue reproduces, MindFort adds it to **Findings** with evidence. If it does not, you get a summary of what was tested.

Use Validator for issues that come from outside MindFort, such as scanner output, a bug bounty submission, or something a teammate noticed. To check whether an existing MindFort finding has been fixed, use [Retesting](https://docs.mindfort.ai/guides/retesting.md) instead.

> [!NOTE]
>
> Validator is included on the Scale and Enterprise plans. On other plans, Validator appears locked in the sidebar. Each validation that starts testing uses one credit.

## Before you submit

Confirm that:

* the target is added and [verified](https://docs.mindfort.ai/guides/targets.md#verify-a-web-application-or-api)
* the target has saved [credentials](https://docs.mindfort.ai/guides/authentication-credentials.md) if reproducing the issue requires signing in
* you have permission to retest findings

Owners and admins can submit validations, and custom roles can be granted the same permission. Auditors can view validations but cannot submit, cancel, or retry them.

## Submit a possible finding

1. Open **Validator** from the sidebar.
2. Click **Submit finding**.
3. Select the **Target**.
4. If the issue requires a signed-in user, choose a **Primary credential**. If it involves two accounts, such as one user reaching another user's data, also choose a **Secondary credential**.
5. Enter a short **Title**.
6. Describe the issue in **Finding details**.
7. Click **Submit for validation**.

MindFort opens the validation's page so you can follow its progress.

### Write clear finding details

The clearer the report, the easier the issue is to reproduce. Include:

* the affected URL, endpoint, or parameter
* step-by-step reproduction instructions
* requests, responses, or payloads that show the issue
* the account or role needed, if any
* the expected impact

Finding details can be up to 100 KB. If a report is longer, remove unrelated output such as full scanner logs.

## Understand validation status

| Status | Meaning |
| - | - |
| **Queued** | The validation is waiting to start. No credit has been used, and you can still cancel it. |
| **In progress** | MindFort is testing the issue against the target. |
| **Validated** | The issue reproduced. MindFort created a finding, or linked an existing one, with the evidence. |
| **Rejected** | Testing showed the issue does not reproduce as described. No finding is created. |
| **Failed** | MindFort could not reach a result, for example because the target was unreachable or a credential could not sign in. You can retry it. |
| **Cancelled** | The validation was withdrawn before testing started. You can retry it. |

A **Failed** validation does not mean the issue is fake. It means testing could not finish. Read the result, fix the cause, and retry.

## Review a result

Open a validation from the Validator page to see:

* its status, target, submitter, and submission time
* the credential used
* **Result**, a summary of what MindFort tested and found
* **View finding**, when the issue was validated
* **Submitted report**, the original finding details

The page updates automatically while the validation is queued or in progress.

Validated issues appear in [Findings](https://docs.mindfort.ai/guides/findings.md) like any other finding, so you can triage, assign, [retest](https://docs.mindfort.ai/guides/retesting.md), or [patch](https://docs.mindfort.ai/guides/patching.md) them.

## Track submissions

The Validator page lists every submission in your organization. You can:

* use the status tabs to see counts and narrow the list
* search by title, or filter by target or submitter (choose **Submitted by me** to see your own)
* sort by newest, oldest, recently updated, or title
* switch between the table and board views

The list updates automatically. Click **Refresh** to update it right away.

When validations are waiting, the page header shows a rough estimate of when the queue will clear. Validations for the same target run one at a time, so many submissions for one target take longer to finish.

## Cancel a queued validation

You can cancel a validation while it is **Queued**:

1. Open the validation.
2. Click **Cancel validation**, then confirm.

The validation moves to **Cancelled** and no credit is used. You can retry it later.

## Retry a validation

You can retry a validation that is **Failed** or **Cancelled**:

1. Open the validation.
2. Under **Retry validation**, optionally change the **Primary credential** or **Secondary credential**. **Keep previous selection** reuses the original choice.
3. Click **Retry validation**.

The retry uses the original title and finding details. Before retrying a failed validation, fix what caused the failure, such as an expired credential or an unreachable target.

> [!WARNING]
>
> Each retry that starts testing uses one credit, even if it fails again.

**Rejected** validations cannot be retried. If you have new information, submit a new report with more detail.

## Use Validator from MCP

When the [MindFort MCP server](https://docs.mindfort.ai/guides/mcp.md) is connected, your AI agent can submit and track validations for you. The same plans, permissions, credits, and status rules apply.

Example prompt:

```text theme={null}
Submit this bug bounty report to MindFort Validator for the staging target and tell me the result when it finishes.
```

Through MCP, your agent can also:

* suggest a severity for the issue
* request white-box validation, which also reviews the source code repository [linked to the target](https://docs.mindfort.ai/guides/targets.md#link-source-repositories)

## Troubleshooting

* **Validator is locked in the sidebar:** Your plan does not include Validator. Upgrade to the Scale or Enterprise plan in **Billing**. The Scale plan appears as **Pro** in the dashboard.
* **Submit finding is not shown:** You need permission to retest findings. Auditors cannot submit validations.
* **No credentials to choose:** Add credentials to the target in **Target Inventory**, then return to the form.
* **A validation failed:** Read the result, confirm the target is reachable, update [credentials](https://docs.mindfort.ai/guides/authentication-credentials.md) or [login instructions](https://docs.mindfort.ai/guides/login-instructions.md) if needed, then retry.
* **A validation is taking a long time:** Check the queue estimate on the Validator page. Other validations for the same target may be running first.

If the issue continues, contact [support@mindfort.ai](mailto:support@mindfort.ai) with the validation link and the result shown in MindFort.

## Next steps

* Triage validated issues in [Findings](https://docs.mindfort.ai/guides/findings.md).
* Check a deployed fix with [Retesting](https://docs.mindfort.ai/guides/retesting.md).
* Run a broader [assessment](https://docs.mindfort.ai/guides/assessments.md) to find issues you have not reported yet.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.