From finding to report with Ruso

A scan is only half the job. The other half is a report someone can act on, and a Ruso check makes that second half cheap: the script already carries its own name, its severity, and the exact traffic it sent.

Name the check as a finding

name "Missing Content-Security-Policy"
severity medium

http page { url "https://{{scan_host}}/" }

send page
match page.response.headers not_contains "content-security-policy"

Write name the way it should read in the report — "Missing Content-Security-Policy", not "Check CSP". severity decides which section of the report it lands in, so set it once, here, instead of triaging by hand later.

Run once, keep the output

ruso scan --target app.internal --script csp.rbc > findings.txt

Every line is already a report row — target, severity, name, path, and the script that produced it:

app.internal  medium  Missing Content-Security-Policy  /  (csp.rbc)

Because the check and its evidence share one line, you never have to reconstruct what was tested. The finding is self-contained.

Group by severity, not by host

Bucket the lines into high, medium, and low. Most readers decide what to fix first from the severity column, not the asset list — group the way they triage.

Attach the artifact, not a screenshot

ruso compile produces a content-addressed .rbc. The bytes you shipped are the bytes the runtime executed, so the artifact is your proof of what was tested. Point the report at the .rbc instead of pasting terminal output.

Make the gate the "resolved" column

The same command fails the build when a finding meets your threshold:

ruso scan --target "$TARGET" --script csp.rbc --fail-on high

A passing pipeline becomes the "resolved" state in the next report: the finding you fixed no longer turns the build red. That is a regression check for free.

Keep each entry to one paragraph

Per finding: what it is, where, why it matters, the one-line evidence, and the fix. The evidence line above is the whole citation — target, path, script, severity.

Report writing stops being a separate chore once the check carries its own description. Write the script well, and the report is mostly assembly.