---
name: document-finding-screenshots
description: Capture, crop and annotate the screenshots a report shows. Use when a report needs a screenshot - an authentication bypass, admin access or purchase proof.
---

# Document finding screenshots

- Capture only the few screenshots needed to show setup and impact. Inspect each source and final image.
- Edit screenshots deterministically with Pillow or ImageMagick, never with an image-generation model: the pixels are evidence. Crop irrelevant browser chrome, empty space, and unrelated UI while retaining useful context and the authenticated identity or role when relevant. Keep the original capture alongside the edited copy.
- Add at most one focused callout around the vulnerable control, payload result, alert, affected identity, or impact: a `#ff3b30` 4 px rectangle with a label attached at its top-left, using solid `#ff3b30`, 24 px Arial Bold white text, 12 px horizontal and 6 px vertical padding, scaled from a 1440 px-wide image. Leave the image unannotated when there is no meaningful focal point.
- Do not add shadows, arrows, numbers, captions, step lists, or competing callouts. Use another screenshot rather than crowding one image.
- Reference each final image inline using its relative filename and the report format, then pass its path to `toadcli finding publish` with `--screenshot`.