The feed
A chronological ledger showing what happened (a finding suppressed, a source connected, a review completed, a question answered), what it happened to, who caused it, and the change as a readable before and after. Filter by domain, actor, date range and target. Domains are findings, sources, automation, penetration tests, users, pull request reviews, CVE disclosures and context.A record’s own history
Every finding also carries its trail on its own page: first seen, every status change and who made it, every question asked and answered, and every remediation attempt. The feed and the per record trail are the same ledger read two ways. An act touching many records is recorded on each of them, so each record’s history is complete, while the feed shows the single meaningful entry so it stays readable.Two layers
Evidence. One entry per change to any tracked record: what changed, the full before and after state, who caused it, and a hash for tamper evidence. It is append only. It cannot be updated or deleted, and the only way it disappears is when the whole organization is deleted. Interpretation. The readable version: a named action, the target, the cause, and a plain diff. If the two were one thing, correcting a mislabelled event would mean editing history. Keeping them apart means the evidence is written once and never touched, while the way it reads can be improved forever.The actor
Work is attributed where it was caused, not where it executed. A scan a person started and a worker ran hours later is still attributed to that person, and a scheduled scan is never attributed to whoever happens to be logged in.
Actors are stored as identifiers, never as names, so someone changing their name never leaves a stale label behind.