AI-Assisted Review

Hashiro's AI assessment engine generates vulnerability findings as candidates, draft findings that require human review before being finalized. The AI review workflow streamlines triaging, validating, and refining automated discoveries.

Screenshots use fictional demonstration data.

Candidate Review Panel

When AI assessments produce findings, they appear in the candidate review panel within the project's Issues tab. Each candidate can be actioned with:

Action	Effect
Accept	Confirms the finding as valid; it becomes a full issue
Reject	Dismisses the finding as a false positive or irrelevant
Needs Evidence	Requests additional proof before making a decision
Merge	Combines with an existing finding covering the same vulnerability

TIP

Candidates can be marked as publicly visible to clients before full verification. This lets clients see what automated testing discovered while the provider completes the review.

AI Demonstration Regeneration

For accepted or in-progress findings, the AI can regenerate the exploitation demonstration:

1. Select a finding and request demonstration regeneration
2. The AI produces an updated step-by-step proof of exploitation
3. Review the generated content in a preview
4. Apply the demonstration to update the finding, or discard it

This is useful when the original demonstration needs clearer steps, better formatting, or additional context.

AI Merge Proposals

When the AI detects multiple findings describing the same or overlapping vulnerabilities, it can propose a merge:

• The AI analyzes similarity between findings
• A merge proposal shows which findings would be combined
• You can accept or reject the merge
• Accepted merges consolidate findings into a single, comprehensive issue

This prevents duplication and produces cleaner reports.

Workflow Integration

AI-assisted review integrates with the standard issue lifecycle:

AI Assessment → Candidate → Review → Accepted (becomes Open issue)
                                    → Rejected (archived)
                                    → Merged (combined with existing)

All review actions are recorded in the finding's history timeline.