diff --git a/app/(chat)/findings/__tests__/page.test.tsx b/app/(chat)/findings/__tests__/page.test.tsx
new file mode 100644
index 000000000..7cee2d0d5
--- /dev/null
+++ b/app/(chat)/findings/__tests__/page.test.tsx
@@ -0,0 +1,387 @@
+import "@testing-library/jest-dom";
+import { beforeEach, describe, expect, it, jest } from "@jest/globals";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+
+const mockUsePaginatedQuery = jest.fn();
+const mockUseQuery = jest.fn((_ref: unknown, args: any) =>
+  args?.findingId ? mockFinding : undefined,
+);
+const mockConvexQuery = jest.fn();
+const mockDownloadFile = jest.fn();
+const mockCapture = jest.fn();
+const mockPush = jest.fn();
+const mockSearchParams = new URLSearchParams();
+const mockCloseSidebar = jest.fn();
+const mockInitializeNewChat = jest.fn();
+const mockSetChatMode = jest.fn();
+const mockSetTemporaryChatsEnabled = jest.fn();
+
+jest.mock("convex/react", () => ({
+  useConvex: () => ({ query: mockConvexQuery }),
+  useConvexAuth: () => ({ isLoading: false, isAuthenticated: true }),
+  usePaginatedQuery: (...args: unknown[]) => mockUsePaginatedQuery(...args),
+  useQuery: (...args: unknown[]) => mockUseQuery(...args),
+  useMutation: () => jest.fn(),
+}));
+
+jest.mock("@/app/contexts/GlobalState", () => ({
+  useGlobalState: () => ({
+    setChatSidebarOpen: jest.fn(),
+    closeSidebar: mockCloseSidebar,
+    initializeNewChat: mockInitializeNewChat,
+    setChatMode: mockSetChatMode,
+    setTemporaryChatsEnabled: mockSetTemporaryChatsEnabled,
+  }),
+}));
+
+jest.mock("next/navigation", () => ({
+  useRouter: () => ({ push: mockPush }),
+  useSearchParams: () => mockSearchParams,
+}));
+
+jest.mock("@/app/hooks/useTauri", () => ({ navigateToAuth: jest.fn() }));
+jest.mock("@/lib/analytics/client", () => ({
+  captureAuthenticatedEvent: mockCapture,
+}));
+jest.mock("@/lib/utils/file-download", () => ({
+  downloadFile: (...args: unknown[]) => mockDownloadFile(...args),
+}));
+
+const mockFinding = {
+  finding_id: "finding-1",
+  title: "Confirmed IDOR",
+  target: "https://app.example.test",
+  endpoint: "/api/invoices/other",
+  method: "GET",
+  severity: "high",
+  cvss_score: 7.1,
+  category: "access_control",
+  status: "active",
+  chat_id: "chat-1",
+  chat_title: "Invoice test",
+  created_at: Date.now(),
+  updated_at: Date.now(),
+  message_id: "message-1",
+  description: "Another account's invoice is readable.",
+  impact: "Billing data disclosure.",
+  technical_analysis: "Missing owner predicate.",
+  poc_description: "Request another account's invoice.",
+  poc_script_code: "curl /api/invoices/other",
+  remediation_steps: "Add an owner predicate.",
+  evidence: "HTTP 200 returned another account's data.",
+  assumptions: "Ordinary account.",
+  fix_effort: "low",
+  cvss_vector: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+  cvss_breakdown: {
+    attack_vector: "N",
+    attack_complexity: "L",
+    privileges_required: "L",
+    user_interaction: "N",
+    scope: "U",
+    confidentiality: "H",
+    integrity: "N",
+    availability: "N",
+  },
+};
+
+const Page = require("../page").default as typeof import("../page").default;
+
+describe("FindingsPage", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    for (const key of [...mockSearchParams.keys()]) {
+      mockSearchParams.delete(key);
+    }
+    window.history.replaceState({}, "", "/findings");
+    mockUseQuery.mockImplementation((_ref: unknown, args: any) =>
+      args?.findingId ? mockFinding : undefined,
+    );
+    mockUsePaginatedQuery.mockReturnValue({
+      results: [mockFinding],
+      status: "Exhausted",
+      loadMore: jest.fn(),
+    });
+    mockConvexQuery.mockResolvedValue({
+      page: [mockFinding],
+      isDone: true,
+      continueCursor: "",
+    });
+    mockDownloadFile.mockResolvedValue(undefined);
+  });
+
+  it("lists metadata and searches without a source-chat filter", async () => {
+    render(<Page />);
+    expect(screen.getByRole("heading", { name: "Findings" })).toBeVisible();
+    expect(screen.getByRole("button", { name: "Open navigation" })).toHaveClass(
+      "md:hidden",
+    );
+    expect(screen.getByText("Confirmed IDOR")).toBeVisible();
+    expect(screen.queryByText("/api/invoices/other")).toBeNull();
+    expect(screen.getByText("7.1")).toBeVisible();
+    expect(screen.getByTestId("finding-severity-dot-finding-1")).toHaveClass(
+      "bg-orange-500",
+    );
+    expect(screen.getByText("Current Results")).toBeVisible();
+    expect(screen.queryByText("Validation Standard")).toBeNull();
+    expect(screen.queryByText("Evidence + working PoC")).toBeNull();
+    expect(screen.queryByText("Endpoint")).toBeNull();
+    expect(screen.queryByText("Source Chat")).toBeNull();
+    expect(screen.getAllByText("Category").length).toBeGreaterThan(0);
+    expect(screen.getAllByText("Status").length).toBeGreaterThan(0);
+    expect(screen.getByText("Access Control / IDOR")).toBeVisible();
+    expect(screen.getAllByText("Active").length).toBeGreaterThan(0);
+    expect(screen.getByRole("list", { name: "Findings" })).toBeVisible();
+    expect(screen.getByLabelText("Filter by category")).toBeVisible();
+    expect(screen.getByLabelText("Filter by status")).toBeVisible();
+    expect(screen.getByLabelText("Filter by severity")).toBeVisible();
+    expect(screen.queryByLabelText("Filter by source chat")).toBeNull();
+    expect(
+      screen.getByRole("button", { name: "Export findings as CSV" }),
+    ).toBeVisible();
+    expect(
+      screen.getByRole("button", { name: "Start new scan" }),
+    ).toBeVisible();
+
+    fireEvent.change(screen.getByLabelText("Search findings"), {
+      target: { value: "CWE-639" },
+    });
+    await waitFor(() => {
+      expect(mockUsePaginatedQuery).toHaveBeenLastCalledWith(
+        expect.anything(),
+        expect.objectContaining({ search: "CWE-639" }),
+        { initialNumItems: 25 },
+      );
+    });
+    expect(screen.getByText("Best matches for “CWE-639”")).toBeVisible();
+    expect(window.location.search).toBe("?q=CWE-639");
+
+    fireEvent.change(screen.getByLabelText("Search findings"), {
+      target: { value: "" },
+    });
+    await waitFor(() => {
+      expect(window.location.search).toBe("");
+    });
+    expect(mockCapture).toHaveBeenCalledWith("findings_page_viewed");
+  });
+
+  it("filters by category and lifecycle status", async () => {
+    render(<Page />);
+
+    fireEvent.click(screen.getByLabelText("Filter by category"));
+    fireEvent.click(screen.getByRole("option", { name: "Injection" }));
+    await waitFor(() => {
+      expect(mockUsePaginatedQuery).toHaveBeenLastCalledWith(
+        expect.anything(),
+        expect.objectContaining({ category: "injection" }),
+        { initialNumItems: 25 },
+      );
+    });
+
+    fireEvent.click(screen.getByLabelText("Filter by status"));
+    fireEvent.click(screen.getByRole("option", { name: "Closed" }));
+    await waitFor(() => {
+      expect(mockUsePaginatedQuery).toHaveBeenLastCalledWith(
+        expect.anything(),
+        expect.objectContaining({
+          category: "injection",
+          status: "closed",
+        }),
+        { initialNumItems: 25 },
+      );
+    });
+    expect(window.location.search).toContain("category=injection");
+    expect(window.location.search).toContain("status=closed");
+  });
+
+  it("exports the complete filtered summary as CSV", async () => {
+    render(<Page />);
+
+    fireEvent.click(
+      screen.getByRole("button", { name: "Export findings as CSV" }),
+    );
+
+    await waitFor(() => {
+      expect(mockConvexQuery).toHaveBeenCalledWith(expect.anything(), {
+        paginationOpts: { cursor: null, numItems: 25 },
+      });
+      expect(mockDownloadFile).toHaveBeenCalledWith(
+        expect.objectContaining({
+          filename: expect.stringMatching(/^findings-\d{4}-\d{2}-\d{2}\.csv$/),
+          mimeType: "text/csv;charset=utf-8",
+          content: expect.stringContaining(
+            '"Confirmed IDOR","https://app.example.test","Access Control / IDOR","high","7.1","active"',
+          ),
+        }),
+      );
+    });
+  });
+
+  it("guards exported cells against spreadsheet formulas", async () => {
+    mockConvexQuery.mockResolvedValue({
+      page: [
+        {
+          ...mockFinding,
+          title: '=HYPERLINK("https://evil.example","Open")',
+          target: "+cmd|' /C calc'!A0",
+        },
+      ],
+      isDone: true,
+      continueCursor: "",
+    });
+    render(<Page />);
+
+    fireEvent.click(
+      screen.getByRole("button", { name: "Export findings as CSV" }),
+    );
+
+    await waitFor(() => {
+      expect(mockDownloadFile).toHaveBeenCalledWith(
+        expect.objectContaining({
+          content: expect.stringContaining(
+            `"'=HYPERLINK(""https://evil.example"",""Open"")","'+cmd|' /C calc'!A0"`,
+          ),
+        }),
+      );
+    });
+  });
+
+  it("drops legacy source-chat filter parameters", () => {
+    mockSearchParams.set("chat", "chat-1");
+    window.history.replaceState({}, "", "/findings?chat=chat-1");
+
+    render(<Page />);
+
+    expect(screen.queryByLabelText("Filter by source chat")).toBeNull();
+    expect(window.location.search).toBe("");
+    expect(mockUsePaginatedQuery).toHaveBeenLastCalledWith(
+      expect.anything(),
+      expect.not.objectContaining({ chatId: expect.anything() }),
+      { initialNumItems: 25 },
+    );
+  });
+
+  it("guides first-time users into a persistent Agent security test", () => {
+    mockUsePaginatedQuery.mockReturnValue({
+      results: [],
+      status: "Exhausted",
+      loadMore: jest.fn(),
+    });
+
+    render(<Page />);
+
+    expect(screen.getByText("No findings yet")).toBeVisible();
+    expect(
+      screen.getByText(/Once it confirms a vulnerability with solid evidence/i),
+    ).toBeVisible();
+
+    fireEvent.click(
+      screen.getByRole("button", { name: "Start your first scan" }),
+    );
+
+    expect(mockCloseSidebar).toHaveBeenCalled();
+    expect(mockInitializeNewChat).toHaveBeenCalled();
+    expect(mockSetTemporaryChatsEnabled).toHaveBeenCalledWith(false);
+    expect(mockSetChatMode).toHaveBeenCalledWith("agent");
+    expect(mockPush).toHaveBeenCalledWith("/");
+  });
+
+  it("shows a reset action when search results are empty", async () => {
+    mockUsePaginatedQuery.mockReturnValue({
+      results: [],
+      status: "Exhausted",
+      loadMore: jest.fn(),
+    });
+
+    render(<Page />);
+    fireEvent.change(screen.getByLabelText("Search findings"), {
+      target: { value: "missing target" },
+    });
+
+    expect(await screen.findByText("No matching findings")).toBeVisible();
+    fireEvent.click(screen.getByRole("button", { name: "Clear filters" }));
+
+    expect(screen.getByLabelText("Search findings")).toHaveValue("");
+    await waitFor(() => {
+      expect(screen.getByText("No findings yet")).toBeVisible();
+      expect(window.location.search).toBe("");
+    });
+  });
+
+  it("opens and closes the reusable detail in a focused modal", async () => {
+    render(<Page />);
+    const findingRow = screen.getByRole("link", {
+      name: /Confirmed IDOR/i,
+    });
+    expect(findingRow).toHaveAttribute("href", "/findings?finding=finding-1");
+    fireEvent.click(findingRow);
+    const dialog = screen.getByRole("dialog", {
+      name: "Vulnerability Report",
+    });
+    expect(dialog).toBeVisible();
+    expect(dialog).toHaveClass("sm:max-w-6xl", "sm:rounded-2xl");
+    expect(document.querySelector('[data-slot="dialog-overlay"]')).toHaveClass(
+      "bg-black/60",
+      "backdrop-blur-sm",
+    );
+    expect(screen.getByText(mockFinding.description)).toBeVisible();
+    expect(
+      screen.getByRole("link", {
+        name: "Open source message in Invoice test",
+      }),
+    ).toHaveAttribute("href", "/c/chat-1#message=message-1");
+    expect(mockCapture).toHaveBeenCalledWith("finding_viewed", {
+      surface: "findings_page",
+    });
+
+    fireEvent.click(
+      screen.getByRole("button", { name: "Close vulnerability report" }),
+    );
+    await waitFor(() => {
+      expect(screen.queryByText(mockFinding.description)).toBeNull();
+      expect(findingRow).toHaveFocus();
+    });
+    expect(window.location.pathname).toBe("/findings");
+    expect(window.location.search).toBe("");
+  });
+
+  it("opens a finding directly from the URL", () => {
+    mockSearchParams.set("finding", "finding-1");
+    window.history.replaceState({}, "", "/findings?finding=finding-1");
+
+    render(<Page />);
+
+    expect(screen.getByText(mockFinding.description)).toBeVisible();
+    expect(
+      screen.getByRole("button", { name: "Close vulnerability report" }),
+    ).toBeVisible();
+    expect(screen.getByRole("button", { name: "Close Finding" })).toBeVisible();
+    expect(mockCapture).toHaveBeenCalledWith("finding_viewed", {
+      surface: "findings_page",
+    });
+  });
+
+  it("keeps a full-screen mobile close path and restores list focus", async () => {
+    render(<Page />);
+    const findingRow = screen.getByRole("link", {
+      name: /Confirmed IDOR/i,
+    });
+    findingRow.focus();
+    fireEvent.click(findingRow);
+
+    expect(
+      screen.getByRole("dialog", { name: "Vulnerability Report" }),
+    ).toHaveClass("h-dvh", "w-screen");
+    expect(
+      screen.getByRole("button", { name: "Back to Findings" }),
+    ).toBeVisible();
+    expect(screen.getByText(mockFinding.description)).toBeVisible();
+
+    fireEvent.click(screen.getByRole("button", { name: "Back to Findings" }));
+    await waitFor(() => {
+      expect(
+        screen.queryByRole("dialog", { name: "Vulnerability Report" }),
+      ).toBeNull();
+      expect(findingRow).toHaveFocus();
+    });
+  });
+});
diff --git a/app/(chat)/findings/page.tsx b/app/(chat)/findings/page.tsx
new file mode 100644
index 000000000..3af3db5e8
--- /dev/null
+++ b/app/(chat)/findings/page.tsx
@@ -0,0 +1,901 @@
+"use client";
+
+import Link from "next/link";
+import { Suspense, useDeferredValue, useEffect, useRef, useState } from "react";
+import { useConvex, useConvexAuth, usePaginatedQuery } from "convex/react";
+import {
+  ChevronRight,
+  Download,
+  Filter,
+  PanelLeft,
+  Play,
+  Search,
+  ShieldAlert,
+  ShieldCheck,
+  X,
+} from "lucide-react";
+import { useRouter, useSearchParams } from "next/navigation";
+import { api } from "@/convex/_generated/api";
+import { Button } from "@/components/ui/button";
+import {
+  Dialog,
+  DialogClose,
+  DialogContent,
+  DialogTitle,
+} from "@/components/ui/dialog";
+import { Input } from "@/components/ui/input";
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@/components/ui/select";
+import { FindingDetail } from "@/app/components/findings/FindingDetail";
+import {
+  getFindingSeverityClasses,
+  getFindingSeverityDotClasses,
+} from "@/app/components/findings/FindingCard";
+import { FindingRelativeTime } from "@/app/components/findings/FindingTime";
+import { useGlobalState } from "@/app/contexts/GlobalState";
+import { navigateToAuth } from "@/app/hooks/useTauri";
+import { captureAuthenticatedEvent } from "@/lib/analytics/client";
+import {
+  FINDING_CATEGORIES,
+  FINDING_CATEGORY_LABELS,
+} from "@/lib/findings/category";
+import { downloadFile } from "@/lib/utils/file-download";
+import { cn } from "@/lib/utils";
+import type {
+  FindingCategory,
+  FindingSeverity,
+  FindingStatus,
+  FindingSummary,
+} from "@/types/finding";
+import { toast } from "sonner";
+
+const SEVERITIES: FindingSeverity[] = [
+  "critical",
+  "high",
+  "medium",
+  "low",
+  "info",
+];
+
+const getSeverityFilter = (value: string | null): "all" | FindingSeverity =>
+  SEVERITIES.includes(value as FindingSeverity)
+    ? (value as FindingSeverity)
+    : "all";
+
+const getCategoryFilter = (value: string | null): "all" | FindingCategory =>
+  FINDING_CATEGORIES.includes(value as FindingCategory)
+    ? (value as FindingCategory)
+    : "all";
+
+const getStatusFilter = (value: string | null): "all" | FindingStatus =>
+  value === "active" || value === "closed" ? value : "all";
+
+const escapeCsvCell = (value: string | number) => {
+  const raw = String(value);
+  const guarded = /^[=+\-@\t\r]/.test(raw) ? `'${raw}` : raw;
+
+  return `"${guarded.replaceAll('"', '""')}"`;
+};
+
+const getFindingsHref = ({
+  search,
+  severity,
+  category,
+  status,
+  findingId,
+}: {
+  search: string;
+  severity: "all" | FindingSeverity;
+  category: "all" | FindingCategory;
+  status: "all" | FindingStatus;
+  findingId: string | null;
+}) => {
+  const params = new URLSearchParams();
+  if (search) params.set("q", search);
+  if (severity !== "all") params.set("severity", severity);
+  if (category !== "all") params.set("category", category);
+  if (status !== "all") params.set("status", status);
+  if (findingId) params.set("finding", findingId);
+  const query = params.toString();
+  return query ? `/findings?${query}` : "/findings";
+};
+
+const updateFindingsHistory = (
+  href: string,
+  method: "push" | "replace" = "replace",
+) => {
+  window.history[method === "push" ? "pushState" : "replaceState"](
+    null,
+    "",
+    href,
+  );
+};
+
+function FindingsPageContent() {
+  const router = useRouter();
+  const convex = useConvex();
+  const searchParams = useSearchParams();
+  const { isLoading, isAuthenticated } = useConvexAuth();
+  const {
+    setChatSidebarOpen,
+    closeSidebar,
+    initializeNewChat,
+    setChatMode,
+    setTemporaryChatsEnabled,
+  } = useGlobalState();
+  const [search, setSearch] = useState(() => searchParams.get("q") ?? "");
+  const deferredSearch = useDeferredValue(search.trim());
+  const [severity, setSeverity] = useState<"all" | FindingSeverity>(() =>
+    getSeverityFilter(searchParams.get("severity")),
+  );
+  const [category, setCategory] = useState<"all" | FindingCategory>(() =>
+    getCategoryFilter(searchParams.get("category")),
+  );
+  const [status, setStatus] = useState<"all" | FindingStatus>(() =>
+    getStatusFilter(searchParams.get("status")),
+  );
+  const [selectedFindingId, setSelectedFindingId] = useState<string | null>(
+    () => searchParams.get("finding"),
+  );
+  const selectedFindingTriggerRef = useRef<HTMLAnchorElement | null>(null);
+  const [isExporting, setIsExporting] = useState(false);
+
+  useEffect(() => {
+    if (!isLoading && !isAuthenticated) navigateToAuth("/login");
+  }, [isAuthenticated, isLoading]);
+
+  useEffect(() => {
+    if (!isAuthenticated) return;
+    captureAuthenticatedEvent("findings_page_viewed");
+  }, [isAuthenticated]);
+
+  useEffect(() => {
+    const syncFromBrowserHistory = () => {
+      const params = new URLSearchParams(window.location.search);
+      if (params.has("chat")) {
+        params.delete("chat");
+        const query = params.toString();
+        updateFindingsHistory(query ? `/findings?${query}` : "/findings");
+      }
+      setSearch(params.get("q") ?? "");
+      setSeverity(getSeverityFilter(params.get("severity")));
+      setCategory(getCategoryFilter(params.get("category")));
+      setStatus(getStatusFilter(params.get("status")));
+      setSelectedFindingId(params.get("finding"));
+    };
+
+    syncFromBrowserHistory();
+    window.addEventListener("popstate", syncFromBrowserHistory);
+    return () => window.removeEventListener("popstate", syncFromBrowserHistory);
+  }, []);
+
+  useEffect(() => {
+    const currentSearch =
+      new URLSearchParams(window.location.search).get("q") ?? "";
+    if (currentSearch === deferredSearch) return;
+    updateFindingsHistory(
+      getFindingsHref({
+        search: deferredSearch,
+        severity,
+        category,
+        status,
+        findingId: selectedFindingId,
+      }),
+    );
+  }, [category, deferredSearch, selectedFindingId, severity, status]);
+
+  useEffect(() => {
+    if (!selectedFindingId) return;
+    captureAuthenticatedEvent("finding_viewed", { surface: "findings_page" });
+  }, [selectedFindingId]);
+
+  const findingsQuery = usePaginatedQuery(
+    api.findings.listFindings,
+    isAuthenticated
+      ? {
+          ...(deferredSearch ? { search: deferredSearch } : {}),
+          ...(severity !== "all" ? { severity } : {}),
+          ...(category !== "all" ? { category } : {}),
+          ...(status !== "all" ? { status } : {}),
+        }
+      : "skip",
+    { initialNumItems: 25 },
+  );
+  const findings = (findingsQuery.results ?? []) as FindingSummary[];
+  const hasActiveFilters =
+    Boolean(deferredSearch) ||
+    severity !== "all" ||
+    category !== "all" ||
+    status !== "all";
+  const visibleSeverityCounts = findings.reduce<
+    Record<FindingSeverity, number>
+  >(
+    (counts, finding) => {
+      counts[finding.severity] += 1;
+      return counts;
+    },
+    { critical: 0, high: 0, medium: 0, low: 0, info: 0 },
+  );
+  const visibleFindingCount =
+    findingsQuery.status === "Exhausted"
+      ? String(findings.length)
+      : `${findings.length}+`;
+  const visibleStatusCounts = findings.reduce<Record<FindingStatus, number>>(
+    (counts, finding) => {
+      counts[finding.status] += 1;
+      return counts;
+    },
+    { active: 0, closed: 0 },
+  );
+
+  const selectFinding = (findingId: string, trigger: HTMLAnchorElement) => {
+    selectedFindingTriggerRef.current = trigger;
+    setSelectedFindingId(findingId);
+    updateFindingsHistory(
+      getFindingsHref({
+        search: deferredSearch,
+        severity,
+        category,
+        status,
+        findingId,
+      }),
+      selectedFindingId ? "replace" : "push",
+    );
+    closeSidebar();
+  };
+
+  const clearSelectedFinding = () => {
+    setSelectedFindingId(null);
+    updateFindingsHistory(
+      getFindingsHref({
+        search: deferredSearch,
+        severity,
+        category,
+        status,
+        findingId: null,
+      }),
+    );
+  };
+
+  const startNewScan = () => {
+    closeSidebar();
+    initializeNewChat();
+    setTemporaryChatsEnabled(false);
+    setChatMode("agent");
+    router.push("/");
+  };
+
+  const clearFilters = () => {
+    setSearch("");
+    setSeverity("all");
+    setCategory("all");
+    setStatus("all");
+    updateFindingsHistory(
+      getFindingsHref({
+        search: "",
+        severity: "all",
+        category: "all",
+        status: "all",
+        findingId: selectedFindingId,
+      }),
+    );
+  };
+
+  const handleExport = async () => {
+    setIsExporting(true);
+    try {
+      const filters = {
+        ...(deferredSearch ? { search: deferredSearch } : {}),
+        ...(severity !== "all" ? { severity } : {}),
+        ...(category !== "all" ? { category } : {}),
+        ...(status !== "all" ? { status } : {}),
+      };
+      const exportedFindings: FindingSummary[] = [];
+      let cursor: string | null = null;
+      let isDone = false;
+
+      while (!isDone && exportedFindings.length < 5_000) {
+        const result: {
+          page: FindingSummary[];
+          isDone: boolean;
+          continueCursor: string;
+        } = await convex.query(api.findings.listFindings, {
+          ...filters,
+          paginationOpts: { cursor, numItems: 25 },
+        });
+        exportedFindings.push(...result.page);
+        isDone = result.isDone || !result.continueCursor;
+        cursor = result.continueCursor || null;
+      }
+
+      const rows = exportedFindings
+        .slice(0, 5_000)
+        .map((finding) => [
+          finding.title,
+          finding.target,
+          FINDING_CATEGORY_LABELS[finding.category],
+          finding.severity,
+          finding.cvss_score.toFixed(1),
+          finding.status,
+          new Date(finding.created_at).toISOString(),
+        ]);
+      const csv = [
+        ["Title", "Target", "Category", "Severity", "CVSS", "Status", "Found"],
+        ...rows,
+      ]
+        .map((row) => row.map(escapeCsvCell).join(","))
+        .join("\n");
+
+      await downloadFile({
+        filename: `findings-${new Date().toISOString().slice(0, 10)}.csv`,
+        content: csv,
+        mimeType: "text/csv;charset=utf-8",
+      });
+      if (!isDone) {
+        toast.warning("Exported the first 5,000 matching findings.");
+      }
+    } catch {
+      toast.error("Could not export findings. Try again.");
+    } finally {
+      setIsExporting(false);
+    }
+  };
+
+  if (isLoading || !isAuthenticated) {
+    return (
+      <div className="flex h-full items-center justify-center text-sm text-muted-foreground">
+        Loading findings…
+      </div>
+    );
+  }
+
+  return (
+    <div className="flex h-full min-h-0 bg-background">
+      <main className="flex min-w-0 flex-1 flex-col">
+        <header className="flex shrink-0 items-center gap-3 border-b border-border px-4 py-3 sm:px-6">
+          <Button
+            variant="ghost"
+            size="icon"
+            className="md:hidden"
+            onClick={() => setChatSidebarOpen(true)}
+            aria-label="Open navigation"
+          >
+            <PanelLeft className="size-5" aria-hidden="true" />
+          </Button>
+          <div className="hidden size-9 shrink-0 items-center justify-center rounded-lg border border-border bg-muted/30 text-muted-foreground sm:flex">
+            <ShieldCheck className="size-4" aria-hidden="true" />
+          </div>
+          <div className="min-w-0 flex-1">
+            <h1 className="text-lg font-semibold text-foreground">Findings</h1>
+            <p className="hidden text-xs text-muted-foreground sm:block">
+              Confirmed vulnerabilities, evidence, and remediation guidance
+            </p>
+          </div>
+          <div className="flex shrink-0 items-center gap-2">
+            <Button
+              type="button"
+              variant="outline"
+              size="sm"
+              disabled={isExporting || findings.length === 0}
+              onClick={() => void handleExport()}
+              aria-label="Export findings as CSV"
+            >
+              <Download className="size-4" aria-hidden="true" />
+              <span className="hidden sm:inline">
+                {isExporting ? "Exporting…" : "Export"}
+              </span>
+            </Button>
+            <Button type="button" size="sm" onClick={startNewScan}>
+              <Play className="size-4" aria-hidden="true" />
+              Start new scan
+            </Button>
+          </div>
+        </header>
+
+        <div className="min-h-0 flex-1 overflow-y-auto">
+          <div className="mx-auto w-full max-w-[1440px]">
+            {findings.length > 0 ? (
+              <section
+                aria-label="Findings overview"
+                className="border-b border-border px-4 py-5 sm:px-6"
+              >
+                <dl className="grid grid-cols-2 gap-5 xl:grid-cols-[0.7fr_0.7fr_0.7fr_1.6fr] xl:gap-8">
+                  <div>
+                    <dt className="text-[11px] font-medium uppercase tracking-wide text-muted-foreground">
+                      Current Results
+                    </dt>
+                    <dd className="mt-1 text-xl font-semibold tabular-nums text-foreground">
+                      {visibleFindingCount}
+                    </dd>
+                  </div>
+                  <div>
+                    <dt className="text-[11px] font-medium uppercase tracking-wide text-muted-foreground">
+                      By Severity
+                    </dt>
+                    <dd className="mt-1.5 flex flex-wrap gap-1.5">
+                      {SEVERITIES.filter(
+                        (value) => visibleSeverityCounts[value] > 0,
+                      ).map((value) => (
+                        <span
+                          key={value}
+                          className={cn(
+                            "inline-flex items-center gap-1.5 rounded-md border px-2 py-1 text-[11px] font-medium",
+                            getFindingSeverityClasses(value),
+                          )}
+                        >
+                          <span>{value[0].toUpperCase() + value.slice(1)}</span>
+                          <span className="tabular-nums">
+                            {visibleSeverityCounts[value]}
+                          </span>
+                        </span>
+                      ))}
+                    </dd>
+                  </div>
+                  <div>
+                    <dt className="text-[11px] font-medium uppercase tracking-wide text-muted-foreground">
+                      Active
+                    </dt>
+                    <dd className="mt-1 flex items-center gap-2 text-xl font-semibold tabular-nums text-foreground">
+                      <span
+                        className="size-2 rounded-full bg-emerald-500"
+                        aria-hidden="true"
+                      />
+                      {visibleStatusCounts.active}
+                    </dd>
+                  </div>
+                  <div>
+                    <dt className="text-[11px] font-medium uppercase tracking-wide text-muted-foreground">
+                      Closed
+                    </dt>
+                    <dd className="mt-1 flex items-center gap-2 text-xl font-semibold tabular-nums text-foreground">
+                      <span
+                        className="size-2 rounded-full bg-muted-foreground/50"
+                        aria-hidden="true"
+                      />
+                      {visibleStatusCounts.closed}
+                    </dd>
+                  </div>
+                </dl>
+              </section>
+            ) : null}
+
+            <div className="grid min-h-0 p-4 sm:p-6 lg:grid-cols-[240px_minmax(0,1fr)] lg:p-0">
+              <aside
+                aria-labelledby="finding-filters-heading"
+                className="border-b border-border pb-6 lg:border-r lg:border-b-0 lg:px-6 lg:py-6"
+              >
+                <div className="lg:sticky lg:top-6">
+                  <div className="mb-4 flex items-center justify-between gap-3">
+                    <h2
+                      id="finding-filters-heading"
+                      className="flex items-center gap-2 text-sm font-semibold text-foreground"
+                    >
+                      <Filter className="size-4" aria-hidden="true" />
+                      Filters
+                    </h2>
+                    {hasActiveFilters ? (
+                      <Button
+                        type="button"
+                        variant="ghost"
+                        size="sm"
+                        className="h-7 px-2 text-xs text-muted-foreground"
+                        onClick={clearFilters}
+                      >
+                        Clear
+                      </Button>
+                    ) : null}
+                  </div>
+
+                  <div className="space-y-4">
+                    <div className="space-y-1.5">
+                      <label
+                        htmlFor="finding-search"
+                        className="text-xs font-medium text-muted-foreground"
+                      >
+                        Search
+                      </label>
+                      <div className="relative">
+                        <Search
+                          className="pointer-events-none absolute left-3 top-1/2 size-4 -translate-y-1/2 text-muted-foreground"
+                          aria-hidden="true"
+                        />
+                        <Input
+                          id="finding-search"
+                          value={search}
+                          onChange={(event) => setSearch(event.target.value)}
+                          name="finding-search"
+                          autoComplete="off"
+                          placeholder="Search findings…"
+                          className="pl-9"
+                          aria-label="Search findings"
+                        />
+                      </div>
+                    </div>
+
+                    <div className="space-y-1.5">
+                      <span className="text-xs font-medium text-muted-foreground">
+                        Category
+                      </span>
+                      <Select
+                        value={category}
+                        onValueChange={(value) => {
+                          const nextCategory = value as "all" | FindingCategory;
+                          setCategory(nextCategory);
+                          updateFindingsHistory(
+                            getFindingsHref({
+                              search: deferredSearch,
+                              severity,
+                              category: nextCategory,
+                              status,
+                              findingId: selectedFindingId,
+                            }),
+                          );
+                        }}
+                      >
+                        <SelectTrigger
+                          className="w-full"
+                          aria-label="Filter by category"
+                        >
+                          <SelectValue placeholder="All categories" />
+                        </SelectTrigger>
+                        <SelectContent>
+                          <SelectItem value="all">All categories</SelectItem>
+                          {FINDING_CATEGORIES.map((value) => (
+                            <SelectItem key={value} value={value}>
+                              {FINDING_CATEGORY_LABELS[value]}
+                            </SelectItem>
+                          ))}
+                        </SelectContent>
+                      </Select>
+                    </div>
+
+                    <div className="space-y-1.5">
+                      <span className="text-xs font-medium text-muted-foreground">
+                        Status
+                      </span>
+                      <Select
+                        value={status}
+                        onValueChange={(value) => {
+                          const nextStatus = value as "all" | FindingStatus;
+                          setStatus(nextStatus);
+                          updateFindingsHistory(
+                            getFindingsHref({
+                              search: deferredSearch,
+                              severity,
+                              category,
+                              status: nextStatus,
+                              findingId: selectedFindingId,
+                            }),
+                          );
+                        }}
+                      >
+                        <SelectTrigger
+                          className="w-full"
+                          aria-label="Filter by status"
+                        >
+                          <SelectValue placeholder="All statuses" />
+                        </SelectTrigger>
+                        <SelectContent>
+                          <SelectItem value="all">All statuses</SelectItem>
+                          <SelectItem value="active">Active</SelectItem>
+                          <SelectItem value="closed">Closed</SelectItem>
+                        </SelectContent>
+                      </Select>
+                    </div>
+
+                    <div className="space-y-1.5">
+                      <span className="text-xs font-medium text-muted-foreground">
+                        Severity
+                      </span>
+                      <Select
+                        value={severity}
+                        onValueChange={(value) => {
+                          const nextSeverity = value as "all" | FindingSeverity;
+                          setSeverity(nextSeverity);
+                          updateFindingsHistory(
+                            getFindingsHref({
+                              search: deferredSearch,
+                              severity: nextSeverity,
+                              category,
+                              status,
+                              findingId: selectedFindingId,
+                            }),
+                          );
+                        }}
+                      >
+                        <SelectTrigger
+                          className="w-full"
+                          aria-label="Filter by severity"
+                        >
+                          <SelectValue placeholder="All severities" />
+                        </SelectTrigger>
+                        <SelectContent>
+                          <SelectItem value="all">All severities</SelectItem>
+                          {SEVERITIES.map((value) => (
+                            <SelectItem key={value} value={value}>
+                              {value[0].toUpperCase() + value.slice(1)}
+                            </SelectItem>
+                          ))}
+                        </SelectContent>
+                      </Select>
+                    </div>
+                  </div>
+                </div>
+              </aside>
+
+              <section
+                className="min-w-0 pt-6 lg:px-8 lg:py-6"
+                aria-labelledby="findings-results-heading"
+              >
+                <div className="mb-4 flex min-h-9 flex-wrap items-center justify-between gap-2">
+                  <div className="min-w-0">
+                    <h2
+                      id="findings-results-heading"
+                      className="text-base font-semibold text-foreground"
+                    >
+                      {findingsQuery.status === "LoadingFirstPage"
+                        ? "Findings"
+                        : `${visibleFindingCount} ${
+                            findings.length === 1 ? "finding" : "findings"
+                          }`}
+                    </h2>
+                    <p
+                      className="mt-0.5 break-words text-xs text-muted-foreground"
+                      aria-live="polite"
+                    >
+                      {deferredSearch
+                        ? `Best matches for “${deferredSearch}”`
+                        : "Newest confirmed findings first"}
+                    </p>
+                  </div>
+                </div>
+
+                {findingsQuery.status === "LoadingFirstPage" ? (
+                  <div className="flex min-h-64 items-center justify-center rounded-xl border border-border text-sm text-muted-foreground">
+                    Loading findings…
+                  </div>
+                ) : findings.length === 0 ? (
+                  <div className="flex min-h-80 flex-col items-center justify-center gap-3 rounded-xl border border-dashed border-border p-8 text-center">
+                    <div className="flex size-12 items-center justify-center rounded-xl border border-border bg-muted/30">
+                      <ShieldAlert
+                        className="size-6 text-muted-foreground"
+                        aria-hidden="true"
+                      />
+                    </div>
+                    <div>
+                      <p className="font-medium text-foreground">
+                        {hasActiveFilters
+                          ? "No matching findings"
+                          : "No findings yet"}
+                      </p>
+                      <p className="mt-1 max-w-sm text-sm text-muted-foreground">
+                        {hasActiveFilters
+                          ? "Try a different search or clear your filters to see all findings."
+                          : "Use Agent to test a target. Once it confirms a vulnerability with solid evidence and a working proof of concept, you’ll find it here."}
+                      </p>
+                    </div>
+                    {hasActiveFilters ? (
+                      <Button variant="outline" onClick={clearFilters}>
+                        Clear filters
+                      </Button>
+                    ) : (
+                      <Button onClick={startNewScan}>
+                        Start your first scan
+                      </Button>
+                    )}
+                  </div>
+                ) : (
+                  <>
+                    <div
+                      className="hidden grid-cols-[minmax(300px,1.6fr)_minmax(170px,0.8fr)_120px_100px_90px_20px] items-center gap-4 px-4 pb-2 text-[11px] font-medium uppercase tracking-wide text-muted-foreground xl:grid"
+                      aria-hidden="true"
+                    >
+                      <div>Finding</div>
+                      <div>Category</div>
+                      <div>Severity</div>
+                      <div>Status</div>
+                      <div className="text-right">Found</div>
+                      <div />
+                    </div>
+                    <ul className="space-y-2" aria-label="Findings">
+                      {findings.map((finding) => (
+                        <li key={finding.finding_id}>
+                          <Link
+                            href={getFindingsHref({
+                              search: deferredSearch,
+                              severity,
+                              category,
+                              status,
+                              findingId: finding.finding_id,
+                            })}
+                            prefetch={false}
+                            onClick={(event) => {
+                              if (
+                                event.button !== 0 ||
+                                event.metaKey ||
+                                event.ctrlKey ||
+                                event.shiftKey ||
+                                event.altKey
+                              ) {
+                                return;
+                              }
+                              event.preventDefault();
+                              selectFinding(
+                                finding.finding_id,
+                                event.currentTarget,
+                              );
+                            }}
+                            className={cn(
+                              "group block min-w-0 rounded-xl border border-border bg-card/30 p-4 text-left shadow-sm transition-[background-color,border-color] hover:border-foreground/15 hover:bg-muted/30 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring xl:grid xl:grid-cols-[minmax(300px,1.6fr)_minmax(170px,0.8fr)_120px_100px_90px_20px] xl:items-center xl:gap-4",
+                              selectedFindingId === finding.finding_id &&
+                                "border-foreground/20 bg-muted/40",
+                            )}
+                          >
+                            <div className="flex min-w-0 items-start gap-3">
+                              <span
+                                className={cn(
+                                  "mt-1.5 size-2.5 shrink-0 rounded-full",
+                                  getFindingSeverityDotClasses(
+                                    finding.severity,
+                                  ),
+                                )}
+                                aria-hidden="true"
+                              />
+                              <div className="min-w-0 flex-1">
+                                <div className="line-clamp-2 text-sm font-medium leading-5 text-foreground xl:truncate">
+                                  {finding.title}
+                                </div>
+                                <div
+                                  className="mt-1 truncate font-mono text-xs text-muted-foreground"
+                                  translate="no"
+                                >
+                                  {finding.target}
+                                </div>
+                              </div>
+                            </div>
+
+                            <div className="mt-3 text-xs text-muted-foreground xl:mt-0">
+                              {FINDING_CATEGORY_LABELS[finding.category]}
+                            </div>
+
+                            <div className="mt-3 flex items-center justify-between gap-3 xl:mt-0 xl:block">
+                              <span className="inline-flex items-center gap-1.5 text-xs font-medium capitalize text-foreground">
+                                <span
+                                  className={cn(
+                                    "size-2 rounded-full",
+                                    getFindingSeverityDotClasses(
+                                      finding.severity,
+                                    ),
+                                  )}
+                                  aria-hidden="true"
+                                  data-testid={`finding-severity-dot-${finding.finding_id}`}
+                                />
+                                {finding.severity}
+                                <span className="tabular-nums text-muted-foreground">
+                                  {finding.cvss_score.toFixed(1)}
+                                </span>
+                              </span>
+                              <span className="text-xs tabular-nums text-muted-foreground xl:hidden">
+                                <FindingRelativeTime
+                                  timestamp={finding.created_at}
+                                />
+                              </span>
+                            </div>
+
+                            <div className="mt-2 xl:mt-0">
+                              <span className="inline-flex items-center gap-1.5 text-xs font-medium text-foreground">
+                                <span
+                                  className={cn(
+                                    "size-2 rounded-full",
+                                    finding.status === "active"
+                                      ? "bg-emerald-500"
+                                      : "bg-muted-foreground/50",
+                                  )}
+                                  aria-hidden="true"
+                                />
+                                {finding.status === "active"
+                                  ? "Active"
+                                  : "Closed"}
+                              </span>
+                            </div>
+
+                            <div className="hidden text-right text-xs tabular-nums text-muted-foreground xl:block">
+                              <FindingRelativeTime
+                                timestamp={finding.created_at}
+                              />
+                            </div>
+
+                            <ChevronRight
+                              className="hidden size-4 text-muted-foreground transition-transform group-hover:translate-x-0.5 group-hover:text-foreground motion-reduce:transition-none xl:block"
+                              aria-hidden="true"
+                            />
+                          </Link>
+                        </li>
+                      ))}
+                    </ul>
+                  </>
+                )}
+
+                {findingsQuery.status === "CanLoadMore" && (
+                  <div className="flex justify-center p-4">
+                    <Button
+                      variant="outline"
+                      onClick={() => findingsQuery.loadMore(25)}
+                    >
+                      Load more
+                    </Button>
+                  </div>
+                )}
+                {findingsQuery.status === "LoadingMore" && (
+                  <div className="p-4 text-center text-sm text-muted-foreground">
+                    Loading more…
+                  </div>
+                )}
+              </section>
+            </div>
+          </div>
+        </div>
+      </main>
+
+      {selectedFindingId && (
+        <Dialog
+          open
+          onOpenChange={(open) => {
+            if (!open) clearSelectedFinding();
+          }}
+        >
+          <DialogContent
+            showCloseButton={false}
+            overlayClassName="bg-black/60 backdrop-blur-sm"
+            aria-describedby={undefined}
+            onCloseAutoFocus={(event) => {
+              event.preventDefault();
+              if (selectedFindingTriggerRef.current?.isConnected) {
+                selectedFindingTriggerRef.current.focus();
+              }
+            }}
+            className="inset-0 flex h-dvh w-screen max-w-none translate-x-0 translate-y-0 flex-col gap-0 overflow-hidden rounded-none border-0 p-0 shadow-none sm:inset-auto sm:top-1/2 sm:left-1/2 sm:h-[calc(100dvh-3rem)] sm:w-[calc(100vw-3rem)] sm:max-w-6xl sm:-translate-x-1/2 sm:-translate-y-1/2 sm:rounded-2xl sm:border sm:shadow-2xl"
+          >
+            <DialogTitle className="sr-only">Vulnerability Report</DialogTitle>
+            <DialogClose asChild>
+              <Button
+                variant="outline"
+                size="icon"
+                aria-label="Close vulnerability report"
+                className="absolute top-[max(0.75rem,env(safe-area-inset-top))] right-[max(0.75rem,env(safe-area-inset-right))] z-20 size-9 bg-background/90 shadow-sm backdrop-blur-sm sm:top-4 sm:right-4"
+              >
+                <X className="size-4" aria-hidden="true" />
+              </Button>
+            </DialogClose>
+            <div className="min-h-0 flex-1">
+              <FindingDetail
+                findingId={selectedFindingId}
+                surface="findings_page"
+                onRequestClose={clearSelectedFinding}
+              />
+            </div>
+          </DialogContent>
+        </Dialog>
+      )}
+    </div>
+  );
+}
+
+export default function FindingsPage() {
+  return (
+    <Suspense
+      fallback={
+        <div className="flex h-full items-center justify-center text-sm text-muted-foreground">
+          Loading findings…
+        </div>
+      }
+    >
+      <FindingsPageContent />
+    </Suspense>
+  );
+}
diff --git a/app/components/ComputerSidebar.tsx b/app/components/ComputerSidebar.tsx
index 6b14bd27c..14f2eb209 100644
--- a/app/components/ComputerSidebar.tsx
+++ b/app/components/ComputerSidebar.tsx
@@ -13,6 +13,7 @@ import {
   Play,
   SkipBack,
   SkipForward,
+  X,
 } from "lucide-react";
 import { useState, useEffect, useRef, useMemo } from "react";
 import { useGlobalState } from "../contexts/GlobalState";
@@ -31,11 +32,15 @@ import {
   isSidebarProxy,
   isSidebarWebSearch,
   isSidebarNotes,
+  isSidebarFinding,
+  isSidebarToolError,
   isSidebarSharedFiles,
   type SidebarContent,
   type ChatStatus,
   type NoteCategory,
 } from "@/types/chat";
+import { FindingDetail } from "./findings/FindingDetail";
+import { ToolErrorDetail } from "./tools/ToolErrorDetail";
 import type { Id } from "@/convex/_generated/dataModel";
 import type { FilePart } from "@/types/file";
 import { FilePartRenderer } from "./FilePartRenderer";
@@ -439,6 +444,8 @@ export const ComputerSidebarBase: React.FC<ComputerSidebarProps> = ({
   const isProxy = isSidebarProxy(sidebarContent);
   const isWebSearch = isSidebarWebSearch(sidebarContent);
   const isNotes = isSidebarNotes(sidebarContent);
+  const isFinding = isSidebarFinding(sidebarContent);
+  const isToolError = isSidebarToolError(sidebarContent);
   const isSharedFiles = isSidebarSharedFiles(sidebarContent);
 
   // Use resolved versions for display metadata so streaming updates are reflected
@@ -452,9 +459,13 @@ export const ComputerSidebarBase: React.FC<ComputerSidebarProps> = ({
   const icon = getSidebarIcon(displayContent);
   const toolName = getToolName(displayContent);
   const displayTarget = getDisplayTarget(displayContent);
-  const headerTitle = isProxy
-    ? "HackerAI\u2019s Proxy"
-    : "HackerAI\u2019s Computer";
+  const headerTitle = isFinding
+    ? "Finding"
+    : isToolError
+      ? "Tool details"
+      : isProxy
+        ? "HackerAI\u2019s Proxy"
+        : "HackerAI\u2019s Computer";
 
   const handleClose = () => {
     closeSidebar();
@@ -470,6 +481,8 @@ export const ComputerSidebarBase: React.FC<ComputerSidebarProps> = ({
     setIsWrapped(!isWrapped);
   };
 
+  const usesCloseAction = isFinding || isToolError;
+
   return (
     <div className="h-full w-full top-0 left-0 desktop:top-auto desktop:left-auto desktop:right-auto z-50 fixed desktop:relative desktop:h-full desktop:mr-4 flex-shrink-0">
       <div className="h-full w-full">
@@ -486,14 +499,28 @@ export const ComputerSidebarBase: React.FC<ComputerSidebarProps> = ({
                     type="button"
                     onClick={handleClose}
                     className="w-7 h-7 relative rounded-md inline-flex items-center justify-center gap-2.5 cursor-pointer hover:bg-muted/50 transition-colors"
-                    aria-label="Minimize sidebar"
+                    aria-label={
+                      usesCloseAction ? "Close details" : "Minimize sidebar"
+                    }
                     tabIndex={0}
                     onKeyDown={handleKeyDown}
                   >
-                    <Minimize2 className="w-5 h-5 text-muted-foreground" />
+                    {usesCloseAction ? (
+                      <X
+                        className="w-5 h-5 text-muted-foreground"
+                        aria-hidden="true"
+                      />
+                    ) : (
+                      <Minimize2
+                        className="w-5 h-5 text-muted-foreground"
+                        aria-hidden="true"
+                      />
+                    )}
                   </button>
                 </TooltipTrigger>
-                <TooltipContent>Minimize</TooltipContent>
+                <TooltipContent>
+                  {usesCloseAction ? "Close" : "Minimize"}
+                </TooltipContent>
               </Tooltip>
             </div>
 
@@ -504,8 +531,17 @@ export const ComputerSidebarBase: React.FC<ComputerSidebarProps> = ({
               </div>
               <div className="flex-1 flex flex-col gap-1 min-w-0">
                 <div className="text-[12px] text-muted-foreground">
-                  HackerAI is using{" "}
-                  <span className="text-foreground">{toolName}</span>
+                  {isToolError ? (
+                    <>
+                      <span className="text-foreground">{toolName}</span> needs
+                      attention
+                    </>
+                  ) : (
+                    <>
+                      HackerAI is using{" "}
+                      <span className="text-foreground">{toolName}</span>
+                    </>
+                  )}
                 </div>
                 <div
                   title={`${actionText} ${displayTarget}`}
@@ -542,6 +578,14 @@ export const ComputerSidebarBase: React.FC<ComputerSidebarProps> = ({
                     <div className="max-w-[250px] truncate text-muted-foreground text-sm font-medium">
                       Notes
                     </div>
+                  ) : isFinding ? (
+                    <div className="max-w-[250px] truncate text-muted-foreground text-sm font-medium">
+                      Vulnerability report
+                    </div>
+                  ) : isToolError ? (
+                    <div className="max-w-[250px] truncate text-muted-foreground text-sm font-medium">
+                      Error details
+                    </div>
                   ) : isSharedFiles ? (
                     <div className="max-w-[250px] truncate text-muted-foreground text-sm font-medium">
                       Shared Files
@@ -558,49 +602,53 @@ export const ComputerSidebarBase: React.FC<ComputerSidebarProps> = ({
                 </div>
 
                 {/* Action buttons - far right */}
-                {!isWebSearch && !isNotes && !isSharedFiles && (
-                  <CodeActionButtons
-                    content={
-                      isFile && resolvedFile
-                        ? resolvedFile.content
-                        : isTerminal && resolvedTerminal
-                          ? resolvedTerminal.output
-                            ? `$ ${resolvedTerminal.command}\n${resolvedTerminal.output}`
-                            : `$ ${resolvedTerminal.command}`
-                          : isProxy && resolvedProxy
-                            ? resolvedProxy.output
-                              ? `$ ${resolvedProxy.command}\n${resolvedProxy.output}`
-                              : `$ ${resolvedProxy.command}`
-                            : ""
-                    }
-                    filename={
-                      isFile
-                        ? sidebarContent.action === "searching"
-                          ? "search-results.txt"
-                          : sidebarContent.path.split("/").pop() || "code.txt"
-                        : "terminal-output.txt"
-                    }
-                    language={
-                      isFile
-                        ? sidebarContent.action === "searching"
-                          ? "text"
-                          : sidebarContent.language ||
-                            getLanguageFromPath(sidebarContent.path)
-                        : "ansi"
-                    }
-                    isWrapped={isWrapped}
-                    onToggleWrap={handleToggleWrap}
-                    variant="sidebar"
-                    // xterm manages its own wrapping; the toggle is a no-op
-                    // for interactive PTY output.
-                    showWrap={
-                      !(
-                        (isTerminal && resolvedTerminal?.rawBytes) ||
-                        (isFile && resolvedFile?.action === "viewing")
-                      )
-                    }
-                  />
-                )}
+                {!isWebSearch &&
+                  !isNotes &&
+                  !isFinding &&
+                  !isToolError &&
+                  !isSharedFiles && (
+                    <CodeActionButtons
+                      content={
+                        isFile && resolvedFile
+                          ? resolvedFile.content
+                          : isTerminal && resolvedTerminal
+                            ? resolvedTerminal.output
+                              ? `$ ${resolvedTerminal.command}\n${resolvedTerminal.output}`
+                              : `$ ${resolvedTerminal.command}`
+                            : isProxy && resolvedProxy
+                              ? resolvedProxy.output
+                                ? `$ ${resolvedProxy.command}\n${resolvedProxy.output}`
+                                : `$ ${resolvedProxy.command}`
+                              : ""
+                      }
+                      filename={
+                        isFile
+                          ? sidebarContent.action === "searching"
+                            ? "search-results.txt"
+                            : sidebarContent.path.split("/").pop() || "code.txt"
+                          : "terminal-output.txt"
+                      }
+                      language={
+                        isFile
+                          ? sidebarContent.action === "searching"
+                            ? "text"
+                            : sidebarContent.language ||
+                              getLanguageFromPath(sidebarContent.path)
+                          : "ansi"
+                      }
+                      isWrapped={isWrapped}
+                      onToggleWrap={handleToggleWrap}
+                      variant="sidebar"
+                      // xterm manages its own wrapping; the toggle is a no-op
+                      // for interactive PTY output.
+                      showWrap={
+                        !(
+                          (isTerminal && resolvedTerminal?.rawBytes) ||
+                          (isFile && resolvedFile?.action === "viewing")
+                        )
+                      }
+                    />
+                  )}
               </div>
 
               {/* Content */}
@@ -750,8 +798,7 @@ export const ComputerSidebarBase: React.FC<ComputerSidebarProps> = ({
                                   key={file.fileId || `file-${index}`}
                                   part={{
                                     fileId: file.fileId as
-                                      | Id<"files">
-                                      | undefined,
+                                      Id<"files"> | undefined,
                                     s3Key: file.s3Key,
                                     name: file.name,
                                     filename: file.name,
@@ -766,6 +813,16 @@ export const ComputerSidebarBase: React.FC<ComputerSidebarProps> = ({
                           </div>
                         </div>
                       )}
+                      {isFinding && (
+                        <FindingDetail
+                          findingId={sidebarContent.findingId}
+                          surface="computer_sidebar"
+                          className="font-sans"
+                        />
+                      )}
+                      {isToolError && (
+                        <ToolErrorDetail content={sidebarContent} />
+                      )}
                       {isNotes && (
                         <div className="flex-1 min-h-0 h-full overflow-y-auto">
                           <div className="flex flex-col px-4 py-3">
diff --git a/app/components/MessagePartHandler.tsx b/app/components/MessagePartHandler.tsx
index 129eb03cf..46b117d3f 100644
--- a/app/components/MessagePartHandler.tsx
+++ b/app/components/MessagePartHandler.tsx
@@ -8,12 +8,16 @@ import { HttpRequestToolHandler } from "./tools/HttpRequestToolHandler";
 import { WebToolHandler } from "./tools/WebToolHandler";
 import { TodoToolHandler } from "./tools/TodoToolHandler";
 import { NotesToolHandler } from "./tools/NotesToolHandler";
+import { FindingToolHandler } from "./tools/FindingToolHandler";
+import { ToolValidationErrorHandler } from "./tools/ToolErrorHandler";
+import { FindingCard } from "./findings/FindingCard";
 import { ProxyToolHandler } from "./tools/ProxyToolHandler";
 import { GetTerminalFilesHandler } from "./tools/GetTerminalFilesHandler";
 import { SummarizationHandler } from "./tools/SummarizationHandler";
 import type { ChatStatus } from "@/types";
 import type { FileDetails } from "@/types/file";
 import { ReasoningHandler } from "./ReasoningHandler";
+import { isToolInputValidationError } from "@/lib/chat/tool-error-display";
 
 interface MessagePartHandlerProps {
   message: UIMessage;
@@ -64,7 +68,7 @@ function deepEqual(a: any, b: any): boolean {
 }
 
 // Custom comparison for MessagePartHandler to minimize re-renders
-function arePropsEqual(
+export function areMessagePartHandlerPropsEqual(
   prevProps: MessagePartHandlerProps,
   nextProps: MessagePartHandlerProps,
 ): boolean {
@@ -84,6 +88,8 @@ function arePropsEqual(
   )
     return false;
 
+  if (prevProps.part?.type !== nextProps.part?.type) return false;
+
   // Shared file details change for get_terminal_files during streaming
   // Must be checked before the part reference check below, because the part
   // reference may be stable while new file metadata arrives via the stream.
@@ -103,6 +109,10 @@ function arePropsEqual(
   )
     return false;
 
+  if (prevProps.part?.type === "data-shared-finding") {
+    return deepEqual(prevProps.part.data, nextProps.part.data);
+  }
+
   // For tool parts, compare state and output which change during streaming
   if (
     prevProps.part?.type?.startsWith("tool-") ||
@@ -111,10 +121,12 @@ function arePropsEqual(
     return (
       prevProps.part.state === nextProps.part.state &&
       prevProps.part.toolCallId === nextProps.part.toolCallId &&
+      prevProps.part.toolName === nextProps.part.toolName &&
       prevProps.part.output === nextProps.part.output &&
+      prevProps.part.errorText === nextProps.part.errorText &&
       deepEqual(prevProps.part.approval, nextProps.part.approval) &&
       // Tool input is an object — reference check first (fast path), then
-      // shallow comparison so new objects with identical content don't re-render.
+      // deep comparison so new objects with identical content don't re-render.
       (prevProps.part.input === nextProps.part.input ||
         deepEqual(prevProps.part.input, nextProps.part.input))
     );
@@ -148,6 +160,26 @@ export const MessagePartHandler = memo(function MessagePartHandler({
   terminalOutputByToolCallId,
   sharedFileDetails,
 }: MessagePartHandlerProps) {
+  const validationToolType =
+    typeof part.type === "string" && part.type.startsWith("tool-")
+      ? part.type
+      : part.type === "dynamic-tool" && typeof part.toolName === "string"
+        ? `tool-${part.toolName}`
+        : null;
+  if (
+    validationToolType &&
+    part.state === "output-error" &&
+    isToolInputValidationError(part.errorText)
+  ) {
+    return (
+      <ToolValidationErrorHandler
+        toolType={validationToolType}
+        toolCallId={part.toolCallId || ""}
+        errorText={part.errorText}
+      />
+    );
+  }
+
   // Main switch for different part types
   switch (part.type) {
     case "text": {
@@ -257,6 +289,19 @@ export const MessagePartHandler = memo(function MessagePartHandler({
         <NotesToolHandler part={part} status={status} toolName="delete_note" />
       );
 
+    case "tool-create_vulnerability_report":
+      return <FindingToolHandler part={part} status={status} />;
+
+    case "data-shared-finding":
+      return part.data ? (
+        <FindingCard
+          title={part.data.title}
+          target={part.data.target}
+          severity={part.data.severity}
+          cvssScore={part.data.cvss_score}
+        />
+      ) : null;
+
     case "tool-list_requests":
       return (
         <ProxyToolHandler
@@ -293,4 +338,4 @@ export const MessagePartHandler = memo(function MessagePartHandler({
     default:
       return null;
   }
-}, arePropsEqual);
+}, areMessagePartHandlerPropsEqual);
diff --git a/app/components/Messages.tsx b/app/components/Messages.tsx
index 9a81c3256..1404a5477 100644
--- a/app/components/Messages.tsx
+++ b/app/components/Messages.tsx
@@ -26,6 +26,9 @@ import { hasTextContent } from "@/lib/utils/message-utils";
 import { useDataStreamState } from "./DataStreamProvider";
 import type { RateLimitWarningData } from "./RateLimitWarning";
 import type { SelectedModel } from "@/types";
+import { cn } from "@/lib/utils";
+import { getChatMessageElementId } from "@/lib/findings/source-message";
+import { useSourceMessageNavigation } from "../hooks/useSourceMessageNavigation";
 
 const AllFilesDialog = dynamic(
   () => import("./AllFilesDialog").then((module) => module.AllFilesDialog),
@@ -120,6 +123,11 @@ export const Messages = ({
     () => messages.filter((msg) => !msg.metadata?.isAutoContinue),
     [messages],
   );
+  const sourceMessageId = useSourceMessageNavigation({
+    loadedMessageCount: messages.length,
+    paginationStatus,
+    loadMore,
+  });
 
   // Memoize expensive calculations
   const lastAssistantMessageIndex = useMemo(() => {
@@ -313,46 +321,59 @@ export const Messages = ({
               <Loading size={6} />
             </div>
           )}
-          {visibleMessages.map((message, index) => (
-            <MessageItem
-              key={message.id}
-              message={message}
-              index={index}
-              messagesLength={visibleMessages.length}
-              lastAssistantMessageIndex={lastAssistantMessageIndex}
-              status={status}
-              isEditing={editingMessageId === message.id}
-              isMobile={isMobile}
-              feedbackInputMessageId={feedbackInputMessageId}
-              tempChatFileDetails={tempChatFileDetails}
-              finishReason={finishReason}
-              mode={mode}
-              agentRunSpendCapWarning={agentRunSpendCapWarning}
-              isTemporaryChat={isTemporaryChat}
-              branchedFromChatId={branchedFromChatId}
-              branchedFromChatTitle={branchedFromChatTitle}
-              branchBoundaryIndex={branchBoundaryIndex}
-              onStartEdit={handleStartEdit}
-              onSaveEdit={handleSaveEdit}
-              onCancelEdit={handleCancelEdit}
-              onRegenerate={onRegenerate}
-              onContinue={onContinue}
-              onBranchMessage={
-                onBranchMessage ? handleBranchMessage : undefined
-              }
-              onFeedback={handleFeedback}
-              onFeedbackSubmit={handleFeedbackSubmit}
-              onFeedbackCancel={handleFeedbackCancel}
-              onShowAllFiles={handleShowAllFiles}
-              getCachedUrl={getCachedUrl}
-              showingLoadingIndicator={
-                summarizationStatus?.status === "started" ||
-                uploadStatus?.isUploading ||
-                shouldShowLoadingDots
-              }
-              summarizationStatus={summarizationStatus}
-            />
-          ))}
+          {visibleMessages.map((message, index) => {
+            const isSourceMessage = sourceMessageId === message.id;
+
+            return (
+              <div
+                key={message.id}
+                id={getChatMessageElementId(message.id)}
+                tabIndex={isSourceMessage ? -1 : undefined}
+                className={cn(
+                  "rounded-2xl",
+                  isSourceMessage && "source-message-highlight",
+                )}
+              >
+                <MessageItem
+                  message={message}
+                  index={index}
+                  messagesLength={visibleMessages.length}
+                  lastAssistantMessageIndex={lastAssistantMessageIndex}
+                  status={status}
+                  isEditing={editingMessageId === message.id}
+                  isMobile={isMobile}
+                  feedbackInputMessageId={feedbackInputMessageId}
+                  tempChatFileDetails={tempChatFileDetails}
+                  finishReason={finishReason}
+                  mode={mode}
+                  agentRunSpendCapWarning={agentRunSpendCapWarning}
+                  isTemporaryChat={isTemporaryChat}
+                  branchedFromChatId={branchedFromChatId}
+                  branchedFromChatTitle={branchedFromChatTitle}
+                  branchBoundaryIndex={branchBoundaryIndex}
+                  onStartEdit={handleStartEdit}
+                  onSaveEdit={handleSaveEdit}
+                  onCancelEdit={handleCancelEdit}
+                  onRegenerate={onRegenerate}
+                  onContinue={onContinue}
+                  onBranchMessage={
+                    onBranchMessage ? handleBranchMessage : undefined
+                  }
+                  onFeedback={handleFeedback}
+                  onFeedbackSubmit={handleFeedbackSubmit}
+                  onFeedbackCancel={handleFeedbackCancel}
+                  onShowAllFiles={handleShowAllFiles}
+                  getCachedUrl={getCachedUrl}
+                  showingLoadingIndicator={
+                    summarizationStatus?.status === "started" ||
+                    uploadStatus?.isUploading ||
+                    shouldShowLoadingDots
+                  }
+                  summarizationStatus={summarizationStatus}
+                />
+              </div>
+            );
+          })}
 
           {/* Processing status - upload/loading dots always separate, summarization only when no content */}
           {(showSummarizationSeparately ||
diff --git a/app/components/SidebarHeader.tsx b/app/components/SidebarHeader.tsx
index aa331bd34..7514e0797 100644
--- a/app/components/SidebarHeader.tsx
+++ b/app/components/SidebarHeader.tsx
@@ -1,15 +1,19 @@
 "use client";
 
 import { useState, useEffect, useMemo, FC } from "react";
+import { usePathname, useRouter } from "next/navigation";
 import { Button } from "@/components/ui/button";
 import {
   PanelLeft,
   Sidebar as SidebarIcon,
   SquarePen,
   Search,
+  ShieldAlert,
 } from "lucide-react";
 import { useSidebar } from "@/components/ui/sidebar";
 import { HackerAISVG } from "@/components/icons/hackerai-svg";
+import { useGlobalState } from "../contexts/GlobalState";
+import { useIsMobile } from "@/hooks/use-mobile";
 import { useChats } from "../hooks/useChats";
 import { useStartNewChat } from "../hooks/useStartNewChat";
 import { MessageSearchDialog } from "./MessageSearchDialog";
@@ -36,6 +40,10 @@ const SidebarHeaderContentImpl: FC<SidebarHeaderContentImplProps> = ({
   toggleSidebar,
 }) => {
   const startNewChat = useStartNewChat();
+  const isMobile = useIsMobile();
+  const router = useRouter();
+  const pathname = usePathname();
+  const { setChatSidebarOpen, closeSidebar } = useGlobalState();
 
   // Search dialog state
   const [isSearchOpen, setIsSearchOpen] = useState(false);
@@ -79,6 +87,12 @@ const SidebarHeaderContentImpl: FC<SidebarHeaderContentImplProps> = ({
     setIsSearchOpen(true);
   };
 
+  const handleFindingsOpen = () => {
+    closeSidebar();
+    if (isMobile) setChatSidebarOpen(false);
+    router.push("/findings");
+  };
+
   const handleSearchClose = () => {
     setIsSearchOpen(false);
   };
@@ -140,6 +154,21 @@ const SidebarHeaderContentImpl: FC<SidebarHeaderContentImplProps> = ({
                 <Search className="w-4 h-4" />
               </Button>
             </div>
+
+            <div className="p-1">
+              <Button
+                variant="ghost"
+                size="sm"
+                className={`h-8 w-8 p-0 hover:bg-sidebar-accent/50 ${
+                  pathname === "/findings" ? "bg-sidebar-accent" : ""
+                }`}
+                onClick={handleFindingsOpen}
+                aria-label="Open findings"
+                aria-current={pathname === "/findings" ? "page" : undefined}
+              >
+                <ShieldAlert className="w-4 h-4" />
+              </Button>
+            </div>
           </div>
         </div>
 
@@ -210,6 +239,23 @@ const SidebarHeaderContentImpl: FC<SidebarHeaderContentImplProps> = ({
             </div>
           </Button>
         </div>
+
+        <div className="px-2 py-1">
+          <Button
+            variant="ghost"
+            className={`relative flex w-full justify-start items-center rounded-lg p-2 h-auto hover:bg-sidebar-accent/50 text-left ${
+              pathname === "/findings" ? "bg-sidebar-accent" : ""
+            }`}
+            onClick={handleFindingsOpen}
+            aria-label="Open findings"
+            aria-current={pathname === "/findings" ? "page" : undefined}
+          >
+            <ShieldAlert className="w-4 h-4" />
+            <div className="mr-2 flex-1 overflow-hidden text-clip whitespace-nowrap text-sm font-medium text-left">
+              Findings
+            </div>
+          </Button>
+        </div>
       </div>
 
       {/* Search Dialog */}
diff --git a/app/components/__tests__/ComputerSidebar.reconnect.test.tsx b/app/components/__tests__/ComputerSidebar.reconnect.test.tsx
index 954427d2e..9e73b8168 100644
--- a/app/components/__tests__/ComputerSidebar.reconnect.test.tsx
+++ b/app/components/__tests__/ComputerSidebar.reconnect.test.tsx
@@ -1,6 +1,6 @@
 import "@testing-library/jest-dom";
 import React from "react";
-import { act, render, screen } from "@testing-library/react";
+import { act, fireEvent, render, screen } from "@testing-library/react";
 import {
   afterEach,
   beforeEach,
@@ -10,6 +10,7 @@ import {
   jest,
 } from "@jest/globals";
 import type { SidebarContent } from "@/types/chat";
+import { createToolInputErrorContent } from "@/lib/chat/tool-error-display";
 
 jest.mock("next/dynamic", () => ({
   __esModule: true,
@@ -153,4 +154,45 @@ describe("ComputerSidebar reconnect behavior", () => {
       expect.objectContaining({ toolCallId: "tool-other" }),
     );
   });
+
+  it("shows safe tool failure details and provides a clear close action", () => {
+    const closeSidebar = jest.fn();
+    const rawError =
+      'Invalid input for tool create_vulnerability_report: Value: {"evidence":"private"}';
+    const toolError = createToolInputErrorContent({
+      toolType: "tool-create_vulnerability_report",
+      toolCallId: "finding-error",
+    });
+
+    render(
+      <ComputerSidebarBase
+        sidebarOpen
+        sidebarContent={toolError}
+        closeSidebar={closeSidebar}
+        messages={[
+          {
+            role: "assistant",
+            parts: [
+              {
+                type: "tool-create_vulnerability_report",
+                toolCallId: "finding-error",
+                state: "output-error",
+                errorText: rawError,
+              },
+            ],
+          },
+        ]}
+        status="ready"
+      />,
+    );
+
+    expect(
+      screen.getByText("The vulnerability report wasn’t saved"),
+    ).toBeVisible();
+    expect(screen.getByText("What to do next")).toBeVisible();
+    expect(screen.queryByText(rawError)).not.toBeInTheDocument();
+
+    fireEvent.click(screen.getByRole("button", { name: "Close details" }));
+    expect(closeSidebar).toHaveBeenCalledTimes(1);
+  });
 });
diff --git a/app/components/__tests__/MessagePartHandler.memo.test.ts b/app/components/__tests__/MessagePartHandler.memo.test.ts
new file mode 100644
index 000000000..3f8706a89
--- /dev/null
+++ b/app/components/__tests__/MessagePartHandler.memo.test.ts
@@ -0,0 +1,102 @@
+import { areMessagePartHandlerPropsEqual } from "../MessagePartHandler";
+
+const props = (part: Record<string, unknown>) =>
+  ({
+    message: { id: "message-1", role: "assistant", parts: [part] },
+    part,
+    partIndex: 0,
+    status: "ready",
+  }) as any;
+
+describe("MessagePartHandler memoization", () => {
+  it("re-renders when shared finding metadata changes", () => {
+    const original = props({
+      type: "data-shared-finding",
+      data: {
+        title: "Confirmed IDOR",
+        target: "app.example.test",
+        severity: "high",
+        cvss_score: 7.1,
+      },
+    });
+    const updated = props({
+      type: "data-shared-finding",
+      data: {
+        title: "Confirmed IDOR",
+        target: "api.example.test",
+        severity: "critical",
+        cvss_score: 9.1,
+      },
+    });
+
+    expect(areMessagePartHandlerPropsEqual(original, updated)).toBe(false);
+  });
+
+  it("never treats different part types as equal", () => {
+    const sharedFinding = props({
+      type: "data-shared-finding",
+      data: { title: "Confirmed IDOR" },
+    });
+    const otherData = props({
+      type: "data-notification",
+      data: { title: "Confirmed IDOR" },
+    });
+
+    expect(areMessagePartHandlerPropsEqual(sharedFinding, otherData)).toBe(
+      false,
+    );
+  });
+
+  it("keeps equivalent shared finding data memoized", () => {
+    const first = props({
+      type: "data-shared-finding",
+      data: { title: "Confirmed IDOR", cvss_score: 7.1 },
+    });
+    const second = props({
+      type: "data-shared-finding",
+      data: { title: "Confirmed IDOR", cvss_score: 7.1 },
+    });
+
+    expect(areMessagePartHandlerPropsEqual(first, second)).toBe(true);
+  });
+
+  it("re-renders when a tool error changes classification", () => {
+    const runtimeFailure = props({
+      type: "tool-shell",
+      state: "output-error",
+      toolCallId: "call-1",
+      input: { command: "npm test" },
+      errorText: "Sandbox unavailable",
+    });
+    const validationFailure = props({
+      type: "tool-shell",
+      state: "output-error",
+      toolCallId: "call-1",
+      input: { command: "npm test" },
+      errorText: "Invalid input for tool shell: Type validation failed",
+    });
+
+    expect(
+      areMessagePartHandlerPropsEqual(runtimeFailure, validationFailure),
+    ).toBe(false);
+  });
+
+  it("re-renders when a dynamic tool name changes", () => {
+    const firstTool = props({
+      type: "dynamic-tool",
+      toolName: "first_tool",
+      state: "output-error",
+      toolCallId: "call-1",
+      errorText: "Invalid tool arguments",
+    });
+    const secondTool = props({
+      type: "dynamic-tool",
+      toolName: "second_tool",
+      state: "output-error",
+      toolCallId: "call-1",
+      errorText: "Invalid tool arguments",
+    });
+
+    expect(areMessagePartHandlerPropsEqual(firstTool, secondTool)).toBe(false);
+  });
+});
diff --git a/app/components/__tests__/SidebarHeader.test.tsx b/app/components/__tests__/SidebarHeader.test.tsx
new file mode 100644
index 000000000..d8f57f741
--- /dev/null
+++ b/app/components/__tests__/SidebarHeader.test.tsx
@@ -0,0 +1,61 @@
+import "@testing-library/jest-dom";
+import { render, screen } from "@testing-library/react";
+import SidebarHeader from "../SidebarHeader";
+
+let pathname = "/findings";
+
+jest.mock("next/navigation", () => ({
+  usePathname: () => pathname,
+  useRouter: () => ({ push: jest.fn() }),
+}));
+jest.mock("@/hooks/use-mobile", () => ({ useIsMobile: () => false }));
+jest.mock("@/app/hooks/useChats", () => ({ useChats: jest.fn() }));
+jest.mock("@/app/contexts/GlobalState", () => ({
+  useGlobalState: () => ({
+    setChatSidebarOpen: jest.fn(),
+    closeSidebar: jest.fn(),
+    initializeNewChat: jest.fn(),
+    setTemporaryChatsEnabled: jest.fn(),
+  }),
+}));
+jest.mock("../MessageSearchDialog", () => ({
+  MessageSearchDialog: () => null,
+}));
+
+describe("SidebarHeader findings navigation", () => {
+  afterEach(() => {
+    pathname = "/findings";
+  });
+
+  it.each([true, false])(
+    "marks the findings destination as current when collapsed is %s",
+    (isCollapsed) => {
+      render(
+        <SidebarHeader
+          handleCloseSidebar={jest.fn()}
+          isCollapsed={isCollapsed}
+          isMobileOverlay
+        />,
+      );
+
+      expect(
+        screen.getByRole("button", { name: "Open findings" }),
+      ).toHaveAttribute("aria-current", "page");
+    },
+  );
+
+  it("does not mark findings current on another route", () => {
+    pathname = "/";
+    render(
+      <SidebarHeader
+        handleCloseSidebar={jest.fn()}
+        isCollapsed={false}
+        isMobileOverlay
+      />,
+    );
+
+    expect(
+      screen.getByRole("button", { name: "Open findings" }),
+    ).not.toHaveAttribute("aria-current");
+  });
+});
diff --git a/app/components/computer-sidebar-utils.tsx b/app/components/computer-sidebar-utils.tsx
index 36d9efa1a..3c72da464 100644
--- a/app/components/computer-sidebar-utils.tsx
+++ b/app/components/computer-sidebar-utils.tsx
@@ -7,8 +7,10 @@ import {
   Search,
   FolderSearch,
   StickyNote,
+  ShieldAlert,
   FileDown,
   Radar,
+  CircleAlert,
 } from "lucide-react";
 import {
   isSidebarFile,
@@ -16,6 +18,8 @@ import {
   isSidebarProxy,
   isSidebarWebSearch,
   isSidebarNotes,
+  isSidebarFinding,
+  isSidebarToolError,
   isSidebarSharedFiles,
   type SidebarContent,
   type NoteCategory,
@@ -163,6 +167,10 @@ export function getActionText(content: SidebarContent): string {
     return completedActionMap[content.action];
   }
 
+  if (isSidebarFinding(content)) return "Saved finding";
+
+  if (isSidebarToolError(content)) return "Needs attention";
+
   if (isSidebarSharedFiles(content)) {
     if (content.isExecuting) {
       const ready = content.files.length;
@@ -198,6 +206,10 @@ export function getSidebarIcon(content: SidebarContent): React.ReactNode {
   if (isSidebarTerminal(content)) return <Terminal className={iconClass} />;
   if (isSidebarWebSearch(content)) return <Search className={iconClass} />;
   if (isSidebarNotes(content)) return <StickyNote className={iconClass} />;
+  if (isSidebarFinding(content)) return <ShieldAlert className={iconClass} />;
+  if (isSidebarToolError(content)) {
+    return <CircleAlert className="h-5 w-5 text-destructive" />;
+  }
   if (isSidebarSharedFiles(content)) return <FileDown className={iconClass} />;
   return <Edit className={iconClass} />;
 }
@@ -215,6 +227,8 @@ export function getToolName(content: SidebarContent): string {
   }
   if (isSidebarWebSearch(content)) return "Search";
   if (isSidebarNotes(content)) return "Notes";
+  if (isSidebarFinding(content)) return "Findings";
+  if (isSidebarToolError(content)) return content.toolName;
   if (isSidebarSharedFiles(content)) return "Downloads";
   return "Tool";
 }
@@ -244,6 +258,8 @@ export function getDisplayTarget(content: SidebarContent): string {
     }
     return content.affectedTitle || "";
   }
+  if (isSidebarFinding(content)) return content.title;
+  if (isSidebarToolError(content)) return content.action;
   if (isSidebarSharedFiles(content)) {
     const names = content.files.length
       ? content.files.map((f) => f.name)
diff --git a/app/components/findings/FindingCard.tsx b/app/components/findings/FindingCard.tsx
new file mode 100644
index 000000000..f3b4c8a49
--- /dev/null
+++ b/app/components/findings/FindingCard.tsx
@@ -0,0 +1,92 @@
+"use client";
+
+import { ShieldAlert } from "lucide-react";
+import { cn } from "@/lib/utils";
+import type { FindingSeverity } from "@/types/finding";
+
+const severityClasses: Record<FindingSeverity, string> = {
+  critical: "border-red-500/30 bg-red-500/10 text-red-500",
+  high: "border-orange-500/30 bg-orange-500/10 text-orange-500",
+  medium: "border-yellow-500/30 bg-yellow-500/10 text-yellow-500",
+  low: "border-blue-500/30 bg-blue-500/10 text-blue-500",
+  info: "border-slate-500/30 bg-slate-500/10 text-slate-500",
+};
+
+const severityDotClasses: Record<FindingSeverity, string> = {
+  critical: "bg-red-500",
+  high: "bg-orange-500",
+  medium: "bg-yellow-500",
+  low: "bg-blue-500",
+  info: "bg-slate-500",
+};
+
+export const getFindingSeverityClasses = (severity: FindingSeverity) =>
+  severityClasses[severity];
+
+export const getFindingSeverityDotClasses = (severity: FindingSeverity) =>
+  severityDotClasses[severity];
+
+export function FindingCard({
+  title,
+  target,
+  severity,
+  cvssScore,
+  onClick,
+  className,
+}: {
+  title: string;
+  target: string;
+  severity: FindingSeverity;
+  cvssScore: number;
+  onClick?: () => void;
+  className?: string;
+}) {
+  const content = (
+    <>
+      <div
+        className={cn(
+          "flex size-9 shrink-0 items-center justify-center rounded-lg border",
+          severityClasses[severity],
+        )}
+      >
+        <ShieldAlert className="size-4" aria-hidden="true" />
+      </div>
+      <div className="min-w-0 flex-1 text-left">
+        <div className="truncate text-sm font-medium text-foreground">
+          {title}
+        </div>
+        <div className="mt-0.5 truncate font-mono text-xs text-muted-foreground">
+          {target}
+        </div>
+      </div>
+      <div
+        className={cn(
+          "shrink-0 rounded-md border px-2 py-1 text-[11px] font-semibold uppercase",
+          severityClasses[severity],
+        )}
+      >
+        {severity} · {cvssScore.toFixed(1)}
+      </div>
+    </>
+  );
+
+  const classes = cn(
+    "flex w-full max-w-xl items-center gap-3 rounded-xl border border-border bg-muted/20 p-3",
+    onClick &&
+      "cursor-pointer transition-colors hover:bg-muted/40 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring",
+    className,
+  );
+
+  return onClick ? (
+    <button
+      type="button"
+      className={classes}
+      onClick={onClick}
+      aria-label={`Open finding: ${title}`}
+    >
+      {content}
+    </button>
+  ) : (
+    <div className={classes}>{content}</div>
+  );
+}
diff --git a/app/components/findings/FindingDetail.tsx b/app/components/findings/FindingDetail.tsx
new file mode 100644
index 000000000..f5f717953
--- /dev/null
+++ b/app/components/findings/FindingDetail.tsx
@@ -0,0 +1,950 @@
+"use client";
+
+import Link from "next/link";
+import { useMutation, useQuery } from "convex/react";
+import { api } from "@/convex/_generated/api";
+import {
+  ArrowLeft,
+  CheckCircle2,
+  ChevronDown,
+  Clock3,
+  Copy,
+  LockKeyhole,
+  MessageSquareText,
+  ShieldAlert,
+  ShieldCheck,
+  Target,
+} from "lucide-react";
+import { useState } from "react";
+import { toast } from "sonner";
+import { Button } from "@/components/ui/button";
+import {
+  Collapsible,
+  CollapsibleContent,
+  CollapsibleTrigger,
+} from "@/components/ui/collapsible";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from "@/components/ui/dialog";
+import { RadioGroup, RadioGroupItem } from "@/components/ui/radio-group";
+import { Textarea } from "@/components/ui/textarea";
+import { MemoizedMarkdown } from "@/app/components/MemoizedMarkdown";
+import { FINDING_CATEGORY_LABELS } from "@/lib/findings/category";
+import {
+  FINDING_CLOSURE_CONTEXT_MAX,
+  FINDING_CLOSURE_REASON_LABELS,
+  FINDING_CLOSURE_REASONS,
+} from "@/lib/findings/lifecycle";
+import type {
+  Cvss31Breakdown,
+  FindingClosureReason,
+  FindingDetailRecord,
+} from "@/types/finding";
+import { cn } from "@/lib/utils";
+import { getSourceMessageHref } from "@/lib/findings/source-message";
+import {
+  getFindingSeverityClasses,
+  getFindingSeverityDotClasses,
+} from "./FindingCard";
+import { FindingDiscoveredAt } from "./FindingTime";
+
+const CVSS_METRICS: Array<{
+  key: keyof Cvss31Breakdown;
+  label: string;
+}> = [
+  { key: "attack_vector", label: "Attack Vector" },
+  { key: "attack_complexity", label: "Attack Complexity" },
+  { key: "privileges_required", label: "Privileges Required" },
+  { key: "user_interaction", label: "User Interaction" },
+  { key: "scope", label: "Scope" },
+  { key: "confidentiality", label: "Confidentiality" },
+  { key: "integrity", label: "Integrity" },
+  { key: "availability", label: "Availability" },
+];
+
+const CVSS_VALUE_LABELS: Record<
+  keyof Cvss31Breakdown,
+  Record<string, string>
+> = {
+  attack_vector: {
+    N: "Network",
+    A: "Adjacent",
+    L: "Local",
+    P: "Physical",
+  },
+  attack_complexity: { L: "Low", H: "High" },
+  privileges_required: { N: "None", L: "Low", H: "High" },
+  user_interaction: { N: "None", R: "Required" },
+  scope: { U: "Unchanged", C: "Changed" },
+  confidentiality: { N: "None", L: "Low", H: "High" },
+  integrity: { N: "None", L: "Low", H: "High" },
+  availability: { N: "None", L: "Low", H: "High" },
+};
+
+const CVSS_VALUE_EXPLANATIONS: Record<
+  keyof Cvss31Breakdown,
+  Record<string, string>
+> = {
+  attack_vector: {
+    N: "Reachable over a network",
+    A: "Requires access to an adjacent network",
+    L: "Requires local system access",
+    P: "Requires physical access",
+  },
+  attack_complexity: {
+    L: "No special conditions are required",
+    H: "Requires conditions beyond the attacker's control",
+  },
+  privileges_required: {
+    N: "No existing account or privileges are required",
+    L: "Requires basic user privileges",
+    H: "Requires elevated privileges",
+  },
+  user_interaction: {
+    N: "No separate user action is required",
+    R: "A separate user must take an action",
+  },
+  scope: {
+    U: "Impact stays within the vulnerable component's security boundary",
+    C: "Impact crosses into another component's security boundary",
+  },
+  confidentiality: {
+    N: "No confidentiality impact was demonstrated",
+    L: "Limited confidential information can be exposed",
+    H: "Broad or critical confidential information can be exposed",
+  },
+  integrity: {
+    N: "No integrity impact was demonstrated",
+    L: "Limited data or behavior can be modified",
+    H: "Broad or critical data or behavior can be modified",
+  },
+  availability: {
+    N: "No availability impact was demonstrated",
+    L: "Availability can be partially reduced",
+    H: "Availability can be severely disrupted",
+  },
+};
+
+const formatLabel = (value: string) =>
+  value.charAt(0).toUpperCase() + value.slice(1).replaceAll("_", " ");
+
+const CopyTextButton = ({
+  value,
+  label,
+  successMessage,
+}: {
+  value: string;
+  label: string;
+  successMessage: string;
+}) => {
+  const handleCopy = async () => {
+    try {
+      await navigator.clipboard.writeText(value);
+      toast.success(successMessage);
+    } catch {
+      toast.error("Could not copy. Try again.");
+    }
+  };
+
+  return (
+    <Button
+      type="button"
+      variant="ghost"
+      size="icon"
+      className="size-8"
+      onClick={() => void handleCopy()}
+      aria-label={label}
+    >
+      <Copy className="size-3.5" aria-hidden="true" />
+    </Button>
+  );
+};
+
+const DetailSection = ({
+  id,
+  title,
+  children,
+}: {
+  id?: string;
+  title: string;
+  children: React.ReactNode;
+}) => (
+  <section
+    className="space-y-3"
+    aria-labelledby={id ? `${id}-heading` : undefined}
+  >
+    <h4
+      id={id ? `${id}-heading` : undefined}
+      className="scroll-mt-20 text-sm font-semibold text-foreground"
+    >
+      {title}
+    </h4>
+    <div className="min-w-0 break-words text-sm leading-6 text-foreground">
+      {children}
+    </div>
+  </section>
+);
+
+const MarkdownSection = ({
+  id,
+  title,
+  value,
+}: {
+  id?: string;
+  title: string;
+  value: string;
+}) => (
+  <DetailSection id={id} title={title}>
+    <MemoizedMarkdown content={value} />
+  </DetailSection>
+);
+
+export function FindingDetail({
+  findingId,
+  finding: suppliedFinding,
+  surface = "detail",
+  className,
+  onRequestClose,
+}: {
+  findingId?: string;
+  finding?: FindingDetailRecord | null;
+  surface?: "computer_sidebar" | "findings_page" | "detail";
+  className?: string;
+  onRequestClose?: () => void;
+}) {
+  const queriedFinding = useQuery(
+    api.findings.getFinding,
+    suppliedFinding !== undefined || !findingId ? "skip" : { findingId },
+  ) as FindingDetailRecord | null | undefined;
+  const closeFinding = useMutation(api.findings.closeFinding);
+  const [isCloseDialogOpen, setIsCloseDialogOpen] = useState(false);
+  const [isClosing, setIsClosing] = useState(false);
+  const [closureReason, setClosureReason] =
+    useState<FindingClosureReason>("already_fixed");
+  const [closureContext, setClosureContext] = useState("");
+  const [localClosure, setLocalClosure] = useState<
+    | Pick<
+        FindingDetailRecord,
+        "status" | "closure_reason" | "closure_context" | "closed_at"
+      >
+    | undefined
+  >();
+  const persistedFinding =
+    suppliedFinding !== undefined ? suppliedFinding : queriedFinding;
+
+  if (persistedFinding === undefined) {
+    return (
+      <div className="flex h-full items-center justify-center p-8 text-sm text-muted-foreground">
+        Loading finding…
+      </div>
+    );
+  }
+
+  if (!persistedFinding) {
+    return (
+      <div className="flex h-full flex-col items-center justify-center gap-3 p-8 text-center">
+        <ShieldAlert
+          className="size-8 text-muted-foreground"
+          aria-hidden="true"
+        />
+        <div>
+          <p className="font-medium text-foreground">Finding deleted</p>
+          <p className="mt-1 text-sm text-muted-foreground">
+            This structured finding is no longer available.
+          </p>
+        </div>
+      </div>
+    );
+  }
+
+  const finding = localClosure
+    ? { ...persistedFinding, ...localClosure }
+    : persistedFinding;
+
+  const handleCloseFinding = async () => {
+    if (!closureContext.trim()) return;
+    setIsClosing(true);
+    try {
+      const result = await closeFinding({
+        findingId: finding.finding_id,
+        reason: closureReason,
+        context: closureContext,
+      });
+      if (result.closed) {
+        setLocalClosure({
+          status: "closed",
+          closure_reason: closureReason,
+          closure_context: closureContext.trim(),
+          closed_at: result.closed_at,
+        });
+        setIsCloseDialogOpen(false);
+        setClosureContext("");
+        toast.success("Finding closed");
+      } else if (result.already_closed) {
+        setIsCloseDialogOpen(false);
+        toast.info("This finding is already closed.");
+      }
+    } catch {
+      toast.error("Could not close finding. Try again.");
+    } finally {
+      setIsClosing(false);
+    }
+  };
+
+  const sectionId = (section: string) => `${finding.finding_id}-${section}`;
+
+  return (
+    <div
+      className={cn(
+        "@container h-full overflow-x-hidden overflow-y-auto overscroll-contain",
+        className,
+      )}
+    >
+      <article className="mx-auto w-full max-w-5xl px-4 pt-[max(1.25rem,env(safe-area-inset-top))] pb-[max(1.25rem,env(safe-area-inset-bottom))] sm:px-6 sm:py-7 @min-[760px]:px-10 @min-[760px]:py-9">
+        <header className="space-y-7 border-b border-border pb-9">
+          {surface === "findings_page" && onRequestClose ? (
+            <Button
+              type="button"
+              variant="ghost"
+              size="sm"
+              className="-ml-3 text-muted-foreground hover:text-foreground"
+              onClick={onRequestClose}
+            >
+              <ArrowLeft className="size-4" aria-hidden="true" />
+              Back to Findings
+            </Button>
+          ) : null}
+
+          <div className="flex flex-col gap-5 @min-[760px]:flex-row @min-[760px]:items-start @min-[760px]:justify-between">
+            <div className="min-w-0 flex-1">
+              <div className="flex flex-wrap items-center gap-2 text-xs font-medium text-muted-foreground">
+                <span className="inline-flex items-center gap-1.5 text-emerald-600 dark:text-emerald-400">
+                  <ShieldCheck className="size-4" aria-hidden="true" />
+                  Confirmed Vulnerability
+                </span>
+                <span aria-hidden="true">·</span>
+                <span className="inline-flex items-center gap-1.5">
+                  <span
+                    className={cn(
+                      "size-1.5 rounded-full",
+                      finding.status === "active"
+                        ? "bg-emerald-500"
+                        : "bg-muted-foreground/60",
+                    )}
+                    aria-hidden="true"
+                  />
+                  {finding.status === "active" ? "Active" : "Closed"}
+                </span>
+              </div>
+
+              <h2 className="mt-3 max-w-4xl text-balance text-2xl font-semibold leading-tight text-foreground @min-[760px]:text-3xl">
+                {finding.title}
+              </h2>
+            </div>
+
+            {surface === "findings_page" ? (
+              <div className="flex min-w-0 shrink-0 flex-col gap-2 @min-[520px]:flex-row @min-[760px]:max-w-sm @min-[760px]:flex-wrap @min-[760px]:justify-end">
+                <Button asChild variant="outline" size="sm">
+                  <Link
+                    href={getSourceMessageHref(
+                      finding.chat_id,
+                      finding.message_id,
+                    )}
+                    aria-label={`Open source message in ${finding.chat_title}`}
+                  >
+                    <MessageSquareText className="size-4" aria-hidden="true" />
+                    Open Source Message
+                  </Link>
+                </Button>
+                {finding.status === "active" ? (
+                  <Button
+                    variant="outline"
+                    size="sm"
+                    onClick={() => setIsCloseDialogOpen(true)}
+                  >
+                    <LockKeyhole className="size-4" aria-hidden="true" />
+                    Close Finding
+                  </Button>
+                ) : null}
+                <span className="min-w-0 truncate text-xs text-muted-foreground @min-[520px]:w-full @min-[760px]:text-right">
+                  From {finding.chat_title}
+                </span>
+              </div>
+            ) : null}
+          </div>
+
+          <dl className="grid gap-x-8 gap-y-6 border-t border-border pt-6 @min-[520px]:grid-cols-2 @min-[880px]:grid-cols-4">
+            <div className="min-w-0">
+              <dt className="text-[11px] font-medium uppercase tracking-wide text-muted-foreground">
+                Severity
+              </dt>
+              <dd className="mt-2 flex items-center gap-2 text-sm font-medium text-foreground">
+                <span
+                  className={cn(
+                    "size-2.5 rounded-full",
+                    getFindingSeverityDotClasses(finding.severity),
+                  )}
+                  aria-hidden="true"
+                />
+                {formatLabel(finding.severity)}
+              </dd>
+              <dd className="mt-1 font-mono text-xs tabular-nums text-muted-foreground">
+                CVSS 3.1 · {finding.cvss_score.toFixed(1)}
+              </dd>
+            </div>
+
+            <div className="min-w-0">
+              <dt className="text-[11px] font-medium uppercase tracking-wide text-muted-foreground">
+                Category
+              </dt>
+              <dd className="mt-2 text-sm font-medium text-foreground">
+                {FINDING_CATEGORY_LABELS[finding.category]}
+              </dd>
+              {finding.cwe || finding.cve ? (
+                <dd
+                  className="mt-1 break-words font-mono text-xs text-muted-foreground"
+                  translate="no"
+                >
+                  {[finding.cwe, finding.cve].filter(Boolean).join(" · ")}
+                </dd>
+              ) : null}
+            </div>
+
+            <div className="min-w-0">
+              <dt className="flex items-center gap-1.5 text-[11px] font-medium uppercase tracking-wide text-muted-foreground">
+                <Target className="size-3.5" aria-hidden="true" />
+                Affected Target
+              </dt>
+              <dd
+                className="mt-2 break-all font-mono text-xs leading-5 text-foreground"
+                translate="no"
+              >
+                {finding.target}
+              </dd>
+              {finding.endpoint ? (
+                <dd
+                  className="mt-1 flex min-w-0 items-start gap-1.5 font-mono text-xs leading-5 text-muted-foreground"
+                  translate="no"
+                >
+                  {finding.method ? (
+                    <span className="shrink-0 font-semibold text-foreground">
+                      {finding.method}
+                    </span>
+                  ) : null}
+                  <span className="min-w-0 break-all">{finding.endpoint}</span>
+                </dd>
+              ) : null}
+            </div>
+
+            <div className="min-w-0">
+              <dt className="text-[11px] font-medium uppercase tracking-wide text-muted-foreground">
+                Fix Effort
+              </dt>
+              <dd className="mt-2 text-sm font-medium text-foreground">
+                {formatLabel(finding.fix_effort)}
+              </dd>
+              <dd className="mt-1 flex items-start gap-1.5 text-xs leading-5 text-muted-foreground">
+                <Clock3
+                  className="mt-0.5 size-3.5 shrink-0"
+                  aria-hidden="true"
+                />
+                Found <FindingDiscoveredAt timestamp={finding.created_at} />
+              </dd>
+            </div>
+          </dl>
+
+          {finding.status === "closed" &&
+          finding.closure_reason &&
+          finding.closure_context ? (
+            <section
+              className="border-l-2 border-muted-foreground/40 pl-4"
+              aria-labelledby={`${finding.finding_id}-closure-heading`}
+            >
+              <div className="flex flex-wrap items-center justify-between gap-2">
+                <h3
+                  id={`${finding.finding_id}-closure-heading`}
+                  className="flex items-center gap-2 text-sm font-semibold text-foreground"
+                >
+                  <LockKeyhole
+                    className="size-4 text-muted-foreground"
+                    aria-hidden="true"
+                  />
+                  Closure Context
+                </h3>
+                <div className="flex flex-wrap items-center gap-2 text-xs text-muted-foreground">
+                  <span className="rounded-md border border-border bg-background px-2 py-1 font-medium text-foreground">
+                    {FINDING_CLOSURE_REASON_LABELS[finding.closure_reason]}
+                  </span>
+                  {finding.closed_at ? (
+                    <span>
+                      Closed{" "}
+                      <FindingDiscoveredAt timestamp={finding.closed_at} />
+                    </span>
+                  ) : null}
+                </div>
+              </div>
+              <p className="mt-3 whitespace-pre-wrap text-sm leading-6 text-foreground">
+                {finding.closure_context}
+              </p>
+            </section>
+          ) : null}
+        </header>
+
+        <div className="pt-9">
+          <div className="min-w-0 max-w-4xl space-y-10 @min-[760px]:space-y-12">
+            <section
+              id={sectionId("overview")}
+              className="scroll-mt-8 space-y-4 border-b border-border pb-10"
+              aria-labelledby={`${sectionId("overview")}-heading`}
+            >
+              <h3
+                id={`${sectionId("overview")}-heading`}
+                className="text-pretty text-lg font-semibold text-foreground"
+              >
+                Summary
+              </h3>
+              <div className="min-w-0 break-words text-sm leading-7 text-foreground">
+                <MemoizedMarkdown content={finding.description} />
+              </div>
+            </section>
+
+            <section
+              className={cn(
+                "space-y-4 rounded-r-lg border-l-2 px-4 py-1",
+                getFindingSeverityClasses(finding.severity),
+              )}
+              aria-labelledby={`${sectionId("overview")}-impact-heading`}
+            >
+              <h3
+                id={`${sectionId("overview")}-impact-heading`}
+                className="flex items-center gap-2 text-lg font-semibold"
+              >
+                <ShieldAlert className="size-4" aria-hidden="true" />
+                Impact
+              </h3>
+              <div className="min-w-0 break-words text-sm leading-7 text-foreground">
+                <MemoizedMarkdown content={finding.impact} />
+              </div>
+            </section>
+
+            <section
+              id={sectionId("technical")}
+              className="scroll-mt-8 space-y-4 border-b border-border pb-10"
+              aria-labelledby={`${sectionId("technical")}-heading`}
+            >
+              <h3
+                id={`${sectionId("technical")}-heading`}
+                className="text-pretty text-lg font-semibold text-foreground"
+              >
+                Root Cause
+              </h3>
+              <div className="min-w-0 break-words text-sm leading-7 text-foreground">
+                <MemoizedMarkdown content={finding.technical_analysis} />
+              </div>
+            </section>
+
+            <section
+              id={sectionId("evidence")}
+              className="scroll-mt-8 space-y-8 border-b border-border pb-10"
+              aria-labelledby={`${sectionId("evidence")}-heading`}
+            >
+              <div className="space-y-1.5">
+                <h3
+                  id={`${sectionId("evidence")}-heading`}
+                  className="text-pretty text-lg font-semibold text-foreground"
+                >
+                  Validation
+                </h3>
+                <p className="text-sm leading-6 text-muted-foreground">
+                  Reproduction steps, observed evidence, and affected locations
+                  used to confirm this vulnerability.
+                </p>
+              </div>
+
+              <section
+                className="border-l-2 border-emerald-500/60 pl-4"
+                aria-labelledby={`${sectionId("evidence")}-captured-heading`}
+              >
+                <h4
+                  id={`${sectionId("evidence")}-captured-heading`}
+                  className="flex items-center gap-2 text-sm font-semibold text-emerald-600 dark:text-emerald-400"
+                >
+                  <CheckCircle2 className="size-4" aria-hidden="true" />
+                  Observed Evidence
+                </h4>
+                <div className="mt-3 min-w-0 break-words text-sm leading-7 text-foreground">
+                  <MemoizedMarkdown content={finding.evidence} />
+                </div>
+              </section>
+
+              <MarkdownSection
+                id={sectionId("reproduce")}
+                title="Reproduction"
+                value={finding.poc_description}
+              />
+
+              <section
+                className="overflow-hidden rounded-xl border border-border bg-muted/15"
+                aria-labelledby={`${sectionId("reproduce")}-payload-heading`}
+              >
+                <div className="flex items-center justify-between gap-3 border-b border-border px-4 py-2.5">
+                  <h4
+                    id={`${sectionId("reproduce")}-payload-heading`}
+                    className="text-sm font-semibold text-foreground"
+                  >
+                    PoC Script or Payload
+                  </h4>
+                  <CopyTextButton
+                    value={finding.poc_script_code}
+                    label="Copy PoC"
+                    successMessage="PoC copied"
+                  />
+                </div>
+                <pre className="max-w-full overflow-x-auto p-4 text-xs leading-relaxed">
+                  <code translate="no">{finding.poc_script_code}</code>
+                </pre>
+              </section>
+
+              {finding.code_locations && finding.code_locations.length > 0 ? (
+                <DetailSection title="Affected Locations">
+                  <div className="space-y-4">
+                    {finding.code_locations.map((location, index) => (
+                      <section
+                        key={`${location.file}:${location.start_line}:${index}`}
+                        className="overflow-hidden rounded-xl border border-border"
+                        aria-label={
+                          location.label ??
+                          `${location.file}:${location.start_line}-${location.end_line}`
+                        }
+                      >
+                        <div className="flex min-w-0 flex-col gap-1 px-4 py-3 @min-[620px]:flex-row @min-[620px]:items-start @min-[620px]:justify-between">
+                          <div className="min-w-0">
+                            {location.label ? (
+                              <div className="text-sm font-medium text-foreground">
+                                {location.label}
+                              </div>
+                            ) : null}
+                            <div
+                              className="mt-0.5 break-all font-mono text-xs text-muted-foreground"
+                              translate="no"
+                            >
+                              {location.file}:{location.start_line}-
+                              {location.end_line}
+                            </div>
+                          </div>
+                          <span className="shrink-0 text-[11px] font-medium uppercase tracking-wide text-muted-foreground">
+                            Source Reference
+                          </span>
+                        </div>
+                        {location.snippet ? (
+                          <pre className="max-w-full overflow-x-auto border-t border-border bg-muted/15 p-4 text-xs leading-relaxed">
+                            <code translate="no">{location.snippet}</code>
+                          </pre>
+                        ) : (
+                          <p className="border-t border-border px-4 py-3 text-xs text-muted-foreground">
+                            No source snippet was included with this report.
+                          </p>
+                        )}
+                      </section>
+                    ))}
+                  </div>
+                </DetailSection>
+              ) : null}
+            </section>
+
+            <section
+              id={sectionId("remediation")}
+              className="scroll-mt-8 space-y-8 border-b border-border pb-10"
+              aria-labelledby={`${sectionId("remediation")}-heading`}
+            >
+              <div className="space-y-1.5">
+                <h3
+                  id={`${sectionId("remediation")}-heading`}
+                  className="text-pretty text-lg font-semibold text-foreground"
+                >
+                  Remediation
+                </h3>
+                <p className="text-sm leading-6 text-muted-foreground">
+                  Recommended changes to remove the root cause and prevent
+                  regression.
+                </p>
+              </div>
+
+              <div className="min-w-0 break-words text-sm leading-7 text-foreground">
+                <MemoizedMarkdown content={finding.remediation_steps} />
+              </div>
+
+              {finding.code_locations?.some(
+                (location) => location.fix_before && location.fix_after,
+              ) ? (
+                <DetailSection title="Suggested Code Changes">
+                  <div className="space-y-4">
+                    {finding.code_locations
+                      ?.filter(
+                        (location) => location.fix_before && location.fix_after,
+                      )
+                      .map((location, index) => (
+                        <section
+                          key={`${location.file}:${location.start_line}:${index}`}
+                          className="rounded-xl border border-border p-4"
+                        >
+                          <div className="flex min-w-0 flex-wrap items-center justify-between gap-2">
+                            <div
+                              className="break-all font-mono text-xs text-foreground"
+                              translate="no"
+                            >
+                              {location.file}:{location.start_line}-
+                              {location.end_line}
+                            </div>
+                            <span className="rounded-md border border-border px-2 py-1 text-[10px] font-medium uppercase tracking-wide text-muted-foreground">
+                              Read-only Guidance
+                            </span>
+                          </div>
+                          <div className="mt-4 grid gap-4 @min-[620px]:grid-cols-2">
+                            <div className="min-w-0">
+                              <div className="mb-1.5 text-[11px] font-medium uppercase text-muted-foreground">
+                                Current Code
+                              </div>
+                              <pre className="max-w-full overflow-x-auto rounded-md border border-red-500/20 bg-red-500/5 p-3 text-xs">
+                                <code translate="no">
+                                  {location.fix_before}
+                                </code>
+                              </pre>
+                            </div>
+                            <div className="min-w-0">
+                              <div className="mb-1.5 text-[11px] font-medium uppercase text-muted-foreground">
+                                Suggested Change
+                              </div>
+                              <pre className="max-w-full overflow-x-auto rounded-md border border-green-500/20 bg-green-500/5 p-3 text-xs">
+                                <code translate="no">{location.fix_after}</code>
+                              </pre>
+                            </div>
+                          </div>
+                        </section>
+                      ))}
+                  </div>
+                </DetailSection>
+              ) : null}
+            </section>
+
+            <section
+              className="space-y-8 pb-4"
+              aria-labelledby={`${sectionId("assessment")}-heading`}
+            >
+              <div className="space-y-1.5">
+                <h3
+                  id={`${sectionId("assessment")}-heading`}
+                  className="text-pretty text-lg font-semibold text-foreground"
+                >
+                  Assessment Details
+                </h3>
+                <p className="text-sm leading-6 text-muted-foreground">
+                  Assumptions and the server-calculated CVSS 3.1 score.
+                </p>
+              </div>
+
+              <MarkdownSection
+                title="Assumptions"
+                value={finding.assumptions}
+              />
+
+              <Collapsible className="group overflow-hidden rounded-xl border border-border bg-muted/10">
+                <CollapsibleTrigger className="flex w-full items-center justify-between gap-4 px-4 py-3.5 text-left transition-colors hover:bg-muted/30 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-inset">
+                  <span className="min-w-0">
+                    <span className="block text-sm font-semibold text-foreground">
+                      Why this severity?
+                    </span>
+                    <span className="mt-0.5 block text-xs leading-5 text-muted-foreground">
+                      See how exploitability and demonstrated impact produced
+                      this score.
+                    </span>
+                  </span>
+                  <ChevronDown
+                    className="size-4 shrink-0 text-muted-foreground transition-transform group-data-[state=open]:rotate-180"
+                    aria-hidden="true"
+                  />
+                </CollapsibleTrigger>
+                <CollapsibleContent className="border-t border-border">
+                  <dl className="grid grid-cols-1 @min-[620px]:grid-cols-2">
+                    {CVSS_METRICS.map((metric) => {
+                      const value = finding.cvss_breakdown[metric.key];
+                      return (
+                        <div
+                          key={metric.key}
+                          className="border-b border-border px-4 py-3 last:border-b-0 @min-[620px]:odd:border-r @min-[620px]:[&:nth-last-child(-n+2)]:border-b-0"
+                        >
+                          <dt className="flex items-center justify-between gap-3 text-xs font-medium text-foreground">
+                            <span>{metric.label}</span>
+                            <span className="shrink-0 rounded-md bg-muted px-1.5 py-0.5 text-[11px] text-muted-foreground">
+                              {CVSS_VALUE_LABELS[metric.key][value] ?? value}
+                            </span>
+                          </dt>
+                          <dd className="mt-1 text-xs leading-5 text-muted-foreground">
+                            {CVSS_VALUE_EXPLANATIONS[metric.key][value]}
+                          </dd>
+                        </div>
+                      );
+                    })}
+                  </dl>
+                </CollapsibleContent>
+              </Collapsible>
+
+              <DetailSection title="CVSS 3.1 Breakdown">
+                <div className="overflow-hidden rounded-lg border border-border">
+                  <dl className="grid grid-cols-1 divide-y divide-border @min-[520px]:grid-cols-2 @min-[520px]:divide-x @min-[520px]:divide-y-0">
+                    {CVSS_METRICS.map((metric) => (
+                      <div
+                        key={metric.key}
+                        className="flex items-center justify-between gap-3 border-b border-border px-3 py-2.5 last:border-b-0 @min-[520px]:[&:nth-last-child(-n+2)]:border-b-0"
+                      >
+                        <dt className="text-xs text-muted-foreground">
+                          {metric.label}
+                        </dt>
+                        <dd className="text-xs font-medium text-foreground">
+                          {CVSS_VALUE_LABELS[metric.key][
+                            finding.cvss_breakdown[metric.key]
+                          ] ?? finding.cvss_breakdown[metric.key]}
+                        </dd>
+                      </div>
+                    ))}
+                  </dl>
+                  <div className="flex min-w-0 items-center gap-2 border-t border-border px-3 py-1.5">
+                    <div
+                      className="min-w-0 flex-1 break-all font-mono text-[11px] text-muted-foreground"
+                      translate="no"
+                    >
+                      {finding.cvss_vector}
+                    </div>
+                    <CopyTextButton
+                      value={finding.cvss_vector}
+                      label="Copy CVSS vector"
+                      successMessage="CVSS vector copied"
+                    />
+                  </div>
+                </div>
+              </DetailSection>
+            </section>
+          </div>
+        </div>
+      </article>
+
+      {surface === "findings_page" ? (
+        <Dialog
+          open={isCloseDialogOpen}
+          onOpenChange={(open) => {
+            if (!isClosing) setIsCloseDialogOpen(open);
+          }}
+        >
+          <DialogContent
+            showCloseButton={!isClosing}
+            overlayClassName="bg-black/60 backdrop-blur-sm"
+            className="max-h-[calc(100dvh-1rem)] overflow-y-auto overscroll-contain p-4 sm:max-w-xl sm:p-6"
+          >
+            <form
+              className="space-y-5 sm:space-y-6"
+              onSubmit={(event) => {
+                event.preventDefault();
+                void handleCloseFinding();
+              }}
+            >
+              <DialogHeader className="pr-8 text-left">
+                <DialogTitle>Close finding</DialogTitle>
+                <DialogDescription>
+                  Choose a reason and leave a note for future reference. You can
+                  still view the report and source message.
+                </DialogDescription>
+              </DialogHeader>
+
+              <fieldset className="space-y-3">
+                <legend className="text-sm font-medium text-foreground">
+                  Why are you closing it?
+                </legend>
+                <RadioGroup
+                  value={closureReason}
+                  onValueChange={(value) =>
+                    setClosureReason(value as FindingClosureReason)
+                  }
+                  className="grid gap-2 sm:grid-cols-3"
+                >
+                  {FINDING_CLOSURE_REASONS.map((reason) => (
+                    <label
+                      key={reason}
+                      htmlFor={`finding-closure-${reason}`}
+                      className={cn(
+                        "flex min-h-12 cursor-pointer items-center gap-2.5 rounded-lg border px-3 py-2.5 text-left transition-colors",
+                        closureReason === reason
+                          ? "border-foreground/50 bg-muted/50 text-foreground"
+                          : "border-border text-muted-foreground hover:bg-muted/30 hover:text-foreground",
+                      )}
+                    >
+                      <RadioGroupItem
+                        id={`finding-closure-${reason}`}
+                        value={reason}
+                        aria-label={FINDING_CLOSURE_REASON_LABELS[reason]}
+                      />
+                      <span className="min-w-0 text-sm font-medium">
+                        {FINDING_CLOSURE_REASON_LABELS[reason]}
+                      </span>
+                    </label>
+                  ))}
+                </RadioGroup>
+              </fieldset>
+
+              <div className="space-y-2">
+                <label
+                  htmlFor="finding-closure-context"
+                  className="text-sm font-medium text-foreground"
+                >
+                  Closure note
+                  <span className="ml-1 font-normal text-muted-foreground">
+                    (required)
+                  </span>
+                </label>
+                <Textarea
+                  id="finding-closure-context"
+                  name="finding-closure-context"
+                  autoComplete="off"
+                  value={closureContext}
+                  onChange={(event) => setClosureContext(event.target.value)}
+                  placeholder="Describe what changed, how it was verified, or why it is being closed…"
+                  maxLength={FINDING_CLOSURE_CONTEXT_MAX}
+                  rows={4}
+                  className="min-h-28 resize-y sm:min-h-32"
+                  required
+                />
+                <div className="flex items-center justify-between gap-3 text-xs text-muted-foreground">
+                  <span>Add enough detail for your future self.</span>
+                  <span className="tabular-nums">
+                    {closureContext.length}/{FINDING_CLOSURE_CONTEXT_MAX}
+                  </span>
+                </div>
+              </div>
+
+              <DialogFooter>
+                <Button
+                  type="button"
+                  variant="outline"
+                  disabled={isClosing}
+                  onClick={() => setIsCloseDialogOpen(false)}
+                >
+                  Cancel
+                </Button>
+                <Button
+                  type="submit"
+                  disabled={isClosing || !closureContext.trim()}
+                >
+                  {isClosing ? "Closing…" : "Close finding"}
+                </Button>
+              </DialogFooter>
+            </form>
+          </DialogContent>
+        </Dialog>
+      ) : null}
+    </div>
+  );
+}
diff --git a/app/components/findings/FindingTime.tsx b/app/components/findings/FindingTime.tsx
new file mode 100644
index 000000000..12df41b5c
--- /dev/null
+++ b/app/components/findings/FindingTime.tsx
@@ -0,0 +1,47 @@
+"use client";
+
+import { formatDistanceToNow } from "date-fns";
+import { useSyncExternalStore } from "react";
+
+const subscribeToHydration = () => () => {};
+const getHydratedSnapshot = () => true;
+const getServerSnapshot = () => false;
+
+const useClientLocale = () =>
+  useSyncExternalStore(
+    subscribeToHydration,
+    getHydratedSnapshot,
+    getServerSnapshot,
+  );
+
+const formatAbsoluteTime = (date: Date, clientLocale: boolean) =>
+  new Intl.DateTimeFormat(clientLocale ? undefined : "en-US", {
+    dateStyle: "medium",
+    timeStyle: "short",
+    ...(clientLocale ? {} : { timeZone: "UTC" }),
+  }).format(date);
+
+export function FindingDiscoveredAt({ timestamp }: { timestamp: number }) {
+  const clientLocale = useClientLocale();
+  const date = new Date(timestamp);
+
+  return (
+    <time dateTime={date.toISOString()}>
+      {formatAbsoluteTime(date, clientLocale)}
+    </time>
+  );
+}
+
+export function FindingRelativeTime({ timestamp }: { timestamp: number }) {
+  const clientLocale = useClientLocale();
+  const date = new Date(timestamp);
+  const absoluteTime = formatAbsoluteTime(date, clientLocale);
+
+  return (
+    <time dateTime={date.toISOString()} title={absoluteTime}>
+      {clientLocale
+        ? formatDistanceToNow(date, { addSuffix: true })
+        : absoluteTime}
+    </time>
+  );
+}
diff --git a/app/components/findings/__tests__/FindingCard.test.tsx b/app/components/findings/__tests__/FindingCard.test.tsx
new file mode 100644
index 000000000..c74eab76f
--- /dev/null
+++ b/app/components/findings/__tests__/FindingCard.test.tsx
@@ -0,0 +1,35 @@
+import "@testing-library/jest-dom";
+import { fireEvent, render, screen } from "@testing-library/react";
+import { FindingCard } from "../FindingCard";
+
+describe("FindingCard", () => {
+  it("is non-clickable when rendered for a public share", () => {
+    render(
+      <FindingCard
+        title="Confirmed IDOR"
+        target="app.example.test"
+        severity="high"
+        cvssScore={7.1}
+      />,
+    );
+    expect(screen.getByText("Confirmed IDOR")).toBeVisible();
+    expect(screen.queryByRole("button")).not.toBeInTheDocument();
+  });
+
+  it("opens an authenticated finding when clickable", () => {
+    const onClick = jest.fn();
+    render(
+      <FindingCard
+        title="Confirmed IDOR"
+        target="app.example.test"
+        severity="high"
+        cvssScore={7.1}
+        onClick={onClick}
+      />,
+    );
+    fireEvent.click(
+      screen.getByRole("button", { name: "Open finding: Confirmed IDOR" }),
+    );
+    expect(onClick).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/app/components/findings/__tests__/FindingDetail.test.tsx b/app/components/findings/__tests__/FindingDetail.test.tsx
new file mode 100644
index 000000000..bc0535d69
--- /dev/null
+++ b/app/components/findings/__tests__/FindingDetail.test.tsx
@@ -0,0 +1,209 @@
+import "@testing-library/jest-dom";
+import { beforeEach, describe, expect, it, jest } from "@jest/globals";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { useMutation } from "convex/react";
+import type { FindingDetailRecord } from "@/types/finding";
+
+Object.defineProperty(global, "ResizeObserver", {
+  configurable: true,
+  value: class ResizeObserver {
+    observe() {}
+    unobserve() {}
+    disconnect() {}
+  },
+});
+
+const { FindingDetail } =
+  require("../FindingDetail") as typeof import("../FindingDetail");
+
+const finding: FindingDetailRecord = {
+  finding_id: "finding-1",
+  title: "Confirmed IDOR",
+  target: "https://app.example.test",
+  endpoint: "/api/invoices/other",
+  method: "GET",
+  severity: "high",
+  cvss_score: 7.1,
+  category: "access_control",
+  status: "active",
+  chat_id: "chat-1",
+  chat_title: "Invoice test",
+  created_at: 1,
+  updated_at: 1,
+  message_id: "message-1",
+  description: "Another account's invoice is readable.",
+  impact: "Billing data disclosure.",
+  technical_analysis: "The handler omits an owner predicate.",
+  poc_description: "Request another account's invoice.",
+  poc_script_code: "curl /api/invoices/other",
+  remediation_steps: "Add an owner predicate.",
+  evidence: "HTTP 200 returned the other account's data.",
+  assumptions: "Ordinary authenticated account.",
+  fix_effort: "low",
+  cvss_vector: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+  cvss_breakdown: {
+    attack_vector: "N",
+    attack_complexity: "L",
+    privileges_required: "L",
+    user_interaction: "N",
+    scope: "U",
+    confidentiality: "H",
+    integrity: "N",
+    availability: "N",
+  },
+  cwe: "CWE-639",
+  code_locations: [
+    {
+      file: "app/api/invoices/route.ts",
+      start_line: 20,
+      end_line: 22,
+      label: "Missing ownership predicate",
+      snippet: "findUnique({ id })",
+      fix_before:
+        "const invoice = await db.invoice.findUnique({\n  where: { id },\n});",
+      fix_after:
+        "const invoice = await db.invoice.findUnique({\n  where: { id, userId },\n});",
+    },
+  ],
+};
+
+describe("FindingDetail", () => {
+  const writeText = jest.fn<() => Promise<void>>();
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    writeText.mockResolvedValue(undefined);
+    Object.defineProperty(navigator, "clipboard", {
+      configurable: true,
+      value: { writeText },
+    });
+  });
+
+  it("renders the complete report and source chat link", () => {
+    render(<FindingDetail finding={finding} surface="findings_page" />);
+    expect(screen.getByRole("heading", { name: finding.title })).toBeVisible();
+    expect(screen.getByText("Confirmed Vulnerability")).toBeVisible();
+    expect(screen.getByText("Access Control / IDOR")).toBeVisible();
+    expect(screen.getByText("Active")).toBeVisible();
+    expect(screen.getByRole("heading", { name: "Summary" })).toBeVisible();
+    expect(screen.getByRole("heading", { name: "Impact" })).toBeVisible();
+    expect(screen.getByRole("heading", { name: "Root Cause" })).toBeVisible();
+    expect(screen.getByRole("heading", { name: "Validation" })).toBeVisible();
+    expect(
+      screen.getByRole("heading", { name: "Observed Evidence" }),
+    ).toBeVisible();
+    expect(screen.getByText("Fix Effort")).toBeVisible();
+    expect(screen.getByText("CWE-639")).toBeVisible();
+    expect(screen.getByText(finding.poc_script_code)).toBeVisible();
+    expect(screen.getByText(finding.evidence)).toBeVisible();
+    expect(
+      screen.getAllByText("app/api/invoices/route.ts:20-22")[0],
+    ).toBeVisible();
+    expect(screen.getByText("Source Reference")).toBeVisible();
+    expect(screen.getByText("Read-only Guidance")).toBeVisible();
+    expect(screen.getByText("Current Code")).toBeVisible();
+    expect(screen.getByText("Suggested Change")).toBeVisible();
+    expect(
+      screen.getByRole("heading", { name: "Assessment Details" }),
+    ).toBeVisible();
+    expect(screen.getByText("Network")).toBeVisible();
+    expect(
+      screen.getByRole("button", { name: /Why this severity\?/ }),
+    ).toHaveAttribute("aria-expanded", "false");
+    expect(
+      screen.getByRole("link", {
+        name: "Open source message in Invoice test",
+      }),
+    ).toHaveAttribute("href", "/c/chat-1#message=message-1");
+  });
+
+  it("explains the CVSS metrics in plain language on request", () => {
+    render(<FindingDetail finding={finding} />);
+
+    expect(screen.queryByText("Reachable over a network")).toBeNull();
+
+    const trigger = screen.getByRole("button", {
+      name: /Why this severity\?/,
+    });
+    fireEvent.click(trigger);
+
+    expect(trigger).toHaveAttribute("aria-expanded", "true");
+    expect(screen.getByText("Reachable over a network")).toBeVisible();
+    expect(screen.getByText("Requires basic user privileges")).toBeVisible();
+    expect(
+      screen.getByText(
+        "Broad or critical confidential information can be exposed",
+      ),
+    ).toBeVisible();
+    expect(
+      screen.getByText("No integrity impact was demonstrated"),
+    ).toBeVisible();
+  });
+
+  it("omits management controls in the chat sidebar", () => {
+    render(<FindingDetail finding={finding} surface="computer_sidebar" />);
+
+    expect(
+      screen.queryByRole("link", {
+        name: "Open source message in Invoice test",
+      }),
+    ).toBeNull();
+    expect(screen.queryByText("Invoice test")).toBeNull();
+    expect(screen.queryByRole("button", { name: "Close Finding" })).toBeNull();
+  });
+
+  it("copies the PoC and CVSS vector", async () => {
+    render(<FindingDetail finding={finding} />);
+
+    fireEvent.click(screen.getByRole("button", { name: "Copy PoC" }));
+    fireEvent.click(screen.getByRole("button", { name: "Copy CVSS vector" }));
+
+    await waitFor(() => {
+      expect(writeText).toHaveBeenNthCalledWith(1, finding.poc_script_code);
+      expect(writeText).toHaveBeenNthCalledWith(2, finding.cvss_vector);
+    });
+  });
+
+  it("requires a resolution and context, then preserves the closed finding", async () => {
+    const mutation = useMutation({} as any) as jest.Mock;
+    mutation.mockResolvedValue({ closed: true, closed_at: 2 });
+    render(<FindingDetail finding={finding} surface="findings_page" />);
+
+    fireEvent.click(screen.getByRole("button", { name: "Close Finding" }));
+    expect(
+      screen.getByRole("heading", { name: "Close finding" }),
+    ).toBeVisible();
+    expect(screen.getByLabelText("Already fixed")).toBeChecked();
+    expect(screen.queryByText("The issue is fixed and retested.")).toBeNull();
+    expect(screen.queryByText("The risk is accepted for now.")).toBeNull();
+    expect(
+      screen.queryByText("The issue is not valid or reproducible."),
+    ).toBeNull();
+    fireEvent.click(screen.getByLabelText("False positive"));
+    fireEvent.change(screen.getByLabelText(/Closure note/), {
+      target: { value: "Could not reproduce after validating tenant scope." },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Close finding" }));
+
+    await waitFor(() => {
+      expect(mutation).toHaveBeenCalledWith({
+        findingId: "finding-1",
+        reason: "false_positive",
+        context: "Could not reproduce after validating tenant scope.",
+      });
+    });
+    expect(screen.getAllByText("Closed").length).toBeGreaterThan(0);
+    expect(screen.getByText("False positive")).toBeVisible();
+    expect(
+      screen.getByText("Could not reproduce after validating tenant scope."),
+    ).toBeVisible();
+    expect(screen.queryByRole("button", { name: "Close Finding" })).toBeNull();
+  });
+
+  it("renders loading and deleted states", () => {
+    const { rerender } = render(<FindingDetail finding={undefined as any} />);
+    expect(screen.getByText("Loading finding…")).toBeVisible();
+    rerender(<FindingDetail finding={null} />);
+    expect(screen.getByText("Finding deleted")).toBeVisible();
+  });
+});
diff --git a/app/components/tools/FindingToolHandler.tsx b/app/components/tools/FindingToolHandler.tsx
new file mode 100644
index 000000000..69fc35c85
--- /dev/null
+++ b/app/components/tools/FindingToolHandler.tsx
@@ -0,0 +1,211 @@
+"use client";
+
+import { memo, useMemo } from "react";
+import { useQuery } from "convex/react";
+import { ShieldAlert } from "lucide-react";
+import { api } from "@/convex/_generated/api";
+import type { ChatStatus, SidebarFinding } from "@/types/chat";
+import type { FindingDetailRecord } from "@/types/finding";
+import { isSidebarFinding } from "@/types/chat";
+import ToolBlock from "@/components/ui/tool-block";
+import { useToolSidebar } from "@/app/hooks/useToolSidebar";
+import { captureAuthenticatedEvent } from "@/lib/analytics/client";
+import { FindingCard } from "@/app/components/findings/FindingCard";
+import {
+  ToolErrorHandler,
+  ToolValidationErrorHandler,
+} from "./ToolErrorHandler";
+import {
+  createFindingFailureContent,
+  isToolInputValidationError,
+} from "@/lib/chat/tool-error-display";
+
+type FindingOutput = {
+  success?: boolean;
+  finding_id?: string;
+  title?: string;
+  target?: string;
+  endpoint?: string;
+  severity?: SidebarFinding["severity"];
+  cvss_score?: number;
+  error?: "validation" | "duplicate" | "chat_not_found" | "general";
+  message?: string;
+};
+
+const failureAction = (output: FindingOutput) => {
+  if (output.error === "duplicate") return "Duplicate finding rejected";
+  return "Finding was not saved";
+};
+
+const SavedFindingCard = ({
+  output,
+  toolCallId,
+}: {
+  output: Required<
+    Pick<
+      FindingOutput,
+      "finding_id" | "title" | "target" | "severity" | "cvss_score"
+    >
+  > &
+    Pick<FindingOutput, "endpoint">;
+  toolCallId: string;
+}) => {
+  const finding = useQuery(api.findings.getFinding, {
+    findingId: output.finding_id,
+  }) as FindingDetailRecord | null | undefined;
+
+  const content = useMemo<SidebarFinding>(
+    () => ({
+      findingId: output.finding_id,
+      title: finding?.title ?? output.title,
+      target: finding?.target ?? output.target,
+      endpoint: finding?.endpoint ?? output.endpoint,
+      severity: finding?.severity ?? output.severity,
+      cvssScore: finding?.cvss_score ?? output.cvss_score,
+      isExecuting: false,
+      toolCallId,
+    }),
+    [finding, output, toolCallId],
+  );
+  const { handleOpenInSidebar } = useToolSidebar({
+    toolCallId,
+    content,
+    typeGuard: isSidebarFinding,
+  });
+
+  if (finding === null) {
+    return (
+      <ToolBlock
+        icon={<ShieldAlert aria-hidden="true" />}
+        action="Finding deleted"
+        target={output.title}
+      />
+    );
+  }
+
+  const handleOpen = () => {
+    captureAuthenticatedEvent("finding_viewed", { surface: "inline_card" });
+    handleOpenInSidebar();
+  };
+
+  return (
+    <FindingCard
+      title={content.title}
+      target={content.endpoint || content.target}
+      severity={content.severity}
+      cvssScore={content.cvssScore}
+      onClick={handleOpen}
+    />
+  );
+};
+
+export const FindingToolHandler = memo(function FindingToolHandler({
+  part,
+  status,
+}: {
+  part: any;
+  status: ChatStatus;
+}) {
+  const { toolCallId = "", state, input, output, errorText } = part;
+  const result = (output?.result ?? output ?? {}) as FindingOutput;
+  const target = input?.title || input?.target;
+
+  if (state === "input-streaming") {
+    return status === "streaming" ? (
+      <ToolBlock
+        icon={<ShieldAlert aria-hidden="true" />}
+        action="Preparing vulnerability report"
+        isShimmer={true}
+      />
+    ) : null;
+  }
+
+  if (state === "input-available") {
+    return status === "streaming" ? (
+      <ToolBlock
+        icon={<ShieldAlert aria-hidden="true" />}
+        action="Saving confirmed finding"
+        target={target}
+        isShimmer={true}
+      />
+    ) : null;
+  }
+
+  if (state === "output-error") {
+    return isToolInputValidationError(errorText) ? (
+      <ToolValidationErrorHandler
+        toolType="tool-create_vulnerability_report"
+        toolCallId={toolCallId}
+        errorText={errorText}
+      />
+    ) : (
+      <ToolErrorHandler
+        content={createFindingFailureContent({
+          toolCallId,
+          reason: "general",
+        })}
+      />
+    );
+  }
+
+  if (state === "output-available") {
+    if (result.success === false) {
+      if (result.error !== "duplicate") {
+        return (
+          <ToolErrorHandler
+            content={createFindingFailureContent({
+              toolCallId,
+              reason:
+                result.error === "validation" ||
+                result.error === "chat_not_found"
+                  ? result.error
+                  : "general",
+            })}
+          />
+        );
+      }
+
+      return (
+        <ToolBlock
+          icon={<ShieldAlert aria-hidden="true" />}
+          action={failureAction(result)}
+          target={result.message}
+        />
+      );
+    }
+
+    if (
+      result.success === true &&
+      result.finding_id &&
+      result.title &&
+      result.target &&
+      result.severity &&
+      typeof result.cvss_score === "number"
+    ) {
+      return (
+        <SavedFindingCard
+          output={{
+            finding_id: result.finding_id,
+            title: result.title,
+            target: result.target,
+            endpoint: result.endpoint,
+            severity: result.severity,
+            cvss_score: result.cvss_score,
+          }}
+          toolCallId={toolCallId}
+        />
+      );
+    }
+
+    return (
+      <ToolErrorHandler
+        content={createFindingFailureContent({
+          toolCallId,
+          reason: "invalid_result",
+        })}
+      />
+    );
+  }
+
+  return null;
+});
diff --git a/app/components/tools/TerminalToolHandler.tsx b/app/components/tools/TerminalToolHandler.tsx
index f456733b8..27d734d8a 100644
--- a/app/components/tools/TerminalToolHandler.tsx
+++ b/app/components/tools/TerminalToolHandler.tsx
@@ -37,6 +37,7 @@ function areTerminalPropsEqual(
   if (prev.part.toolCallId !== next.part.toolCallId) return false;
   if (prev.part.output !== next.part.output) return false;
   if (prev.part.input !== next.part.input) return false;
+  if (prev.part.errorText !== next.part.errorText) return false;
   if (prev.part.approval?.id !== next.part.approval?.id) return false;
   // Compare message.parts length for streaming output updates
   if (prev.message.parts.length !== next.message.parts.length) return false;
diff --git a/app/components/tools/TodoToolHandler.tsx b/app/components/tools/TodoToolHandler.tsx
index 71f4b6286..e8879c40f 100644
--- a/app/components/tools/TodoToolHandler.tsx
+++ b/app/components/tools/TodoToolHandler.tsx
@@ -22,6 +22,7 @@ function areTodoPropsEqual(
   if (prev.part.toolCallId !== next.part.toolCallId) return false;
   if (prev.part.output !== next.part.output) return false;
   if (prev.part.input !== next.part.input) return false;
+  if (prev.part.errorText !== next.part.errorText) return false;
   return true;
 }
 
diff --git a/app/components/tools/ToolErrorDetail.tsx b/app/components/tools/ToolErrorDetail.tsx
new file mode 100644
index 000000000..b95b81734
--- /dev/null
+++ b/app/components/tools/ToolErrorDetail.tsx
@@ -0,0 +1,87 @@
+import { AlertCircle, ArrowRight } from "lucide-react";
+import type { SidebarToolError } from "@/types/chat";
+
+export function ToolErrorDetail({ content }: { content: SidebarToolError }) {
+  return (
+    <div className="h-full overflow-y-auto bg-background font-sans">
+      <div
+        className="mx-auto flex w-full max-w-2xl flex-col gap-5 px-5 py-6"
+        role="status"
+        aria-live="polite"
+      >
+        <div className="flex items-start gap-3">
+          <div className="mt-0.5 flex h-9 w-9 shrink-0 items-center justify-center rounded-lg border border-destructive/20 bg-destructive/10 text-destructive">
+            <AlertCircle className="h-5 w-5" aria-hidden="true" />
+          </div>
+          <div className="min-w-0">
+            <div className="text-xs font-medium uppercase tracking-wide text-destructive">
+              Needs attention
+            </div>
+            <h2 className="mt-1 text-base font-semibold text-foreground">
+              {content.title}
+            </h2>
+          </div>
+        </div>
+
+        <section aria-labelledby="tool-error-what-happened">
+          <h3
+            id="tool-error-what-happened"
+            className="text-xs font-medium uppercase tracking-wide text-muted-foreground"
+          >
+            What happened
+          </h3>
+          <p className="mt-2 text-sm leading-6 text-foreground/85">
+            {content.summary}
+          </p>
+          {content.issues && content.issues.length > 0 && (
+            <ul className="mt-3 space-y-2" aria-label="Fields to review">
+              {content.issues.map((issue) => (
+                <li
+                  key={`${issue.field}-${issue.problem}`}
+                  className="flex items-baseline justify-between gap-4 rounded-lg border border-border/70 bg-muted/15 px-3 py-2 text-sm"
+                >
+                  <span className="min-w-0 break-words font-medium text-foreground">
+                    {issue.field}
+                  </span>
+                  <span className="shrink-0 text-xs text-muted-foreground">
+                    {issue.problem}
+                  </span>
+                </li>
+              ))}
+            </ul>
+          )}
+        </section>
+
+        <section
+          className="rounded-xl border border-border bg-muted/20 p-4"
+          aria-labelledby="tool-error-next-step"
+        >
+          <div className="flex items-start gap-3">
+            <ArrowRight
+              className="mt-0.5 h-4 w-4 shrink-0 text-muted-foreground"
+              aria-hidden="true"
+            />
+            <div>
+              <h3
+                id="tool-error-next-step"
+                className="text-sm font-medium text-foreground"
+              >
+                What to do next
+              </h3>
+              <p className="mt-1 text-sm leading-6 text-muted-foreground">
+                {content.nextStep}
+              </p>
+            </div>
+          </div>
+        </section>
+
+        {content.errorKind === "validation" && (
+          <p className="text-xs leading-5 text-muted-foreground">
+            For your privacy, generated parameters and raw validation data are
+            not shown here.
+          </p>
+        )}
+      </div>
+    </div>
+  );
+}
diff --git a/app/components/tools/ToolErrorHandler.tsx b/app/components/tools/ToolErrorHandler.tsx
new file mode 100644
index 000000000..929e41b59
--- /dev/null
+++ b/app/components/tools/ToolErrorHandler.tsx
@@ -0,0 +1,76 @@
+"use client";
+
+import { memo, useMemo, type KeyboardEventHandler } from "react";
+import { CircleAlert, ShieldAlert } from "lucide-react";
+import ToolBlock from "@/components/ui/tool-block";
+import { isSidebarToolError, type SidebarToolError } from "@/types/chat";
+import { useToolSidebar } from "@/app/hooks/useToolSidebar";
+import { createToolInputErrorContent } from "@/lib/chat/tool-error-display";
+
+export function ToolErrorBlock({
+  content,
+  onOpen,
+  onKeyDown,
+}: {
+  content: SidebarToolError;
+  onOpen: () => void;
+  onKeyDown?: KeyboardEventHandler;
+}) {
+  const isFinding = content.toolName === "Vulnerability report";
+
+  return (
+    <ToolBlock
+      icon={
+        isFinding ? (
+          <ShieldAlert aria-hidden="true" />
+        ) : (
+          <CircleAlert aria-hidden="true" />
+        )
+      }
+      action={content.action}
+      target="View details"
+      isClickable
+      onClick={onOpen}
+      onKeyDown={onKeyDown}
+      ariaLabel={`Open ${content.toolName.toLowerCase()} error details`}
+    />
+  );
+}
+
+export const ToolErrorHandler = memo(function ToolErrorHandler({
+  content,
+}: {
+  content: SidebarToolError;
+}) {
+  const { handleOpenInSidebar, handleKeyDown } = useToolSidebar({
+    toolCallId: content.toolCallId,
+    content,
+    typeGuard: isSidebarToolError,
+  });
+
+  return (
+    <ToolErrorBlock
+      content={content}
+      onOpen={handleOpenInSidebar}
+      onKeyDown={handleKeyDown}
+    />
+  );
+});
+
+export const ToolValidationErrorHandler = memo(
+  function ToolValidationErrorHandler({
+    toolType,
+    toolCallId,
+    errorText,
+  }: {
+    toolType: string;
+    toolCallId: string;
+    errorText?: unknown;
+  }) {
+    const content = useMemo(
+      () => createToolInputErrorContent({ toolType, toolCallId, errorText }),
+      [errorText, toolCallId, toolType],
+    );
+    return <ToolErrorHandler content={content} />;
+  },
+);
diff --git a/app/components/tools/WebToolHandler.tsx b/app/components/tools/WebToolHandler.tsx
index 3933345ae..b9aae5375 100644
--- a/app/components/tools/WebToolHandler.tsx
+++ b/app/components/tools/WebToolHandler.tsx
@@ -46,6 +46,8 @@ function areWebPropsEqual(
   if (prev.part.state !== next.part.state) return false;
   if (prev.part.toolCallId !== next.part.toolCallId) return false;
   if (prev.part.output !== next.part.output) return false;
+  if (prev.part.input !== next.part.input) return false;
+  if (prev.part.errorText !== next.part.errorText) return false;
   return true;
 }
 
diff --git a/app/components/tools/__tests__/FindingToolHandler.test.tsx b/app/components/tools/__tests__/FindingToolHandler.test.tsx
new file mode 100644
index 000000000..d49d42208
--- /dev/null
+++ b/app/components/tools/__tests__/FindingToolHandler.test.tsx
@@ -0,0 +1,180 @@
+import "@testing-library/jest-dom";
+import { beforeEach, describe, expect, it, jest } from "@jest/globals";
+import { fireEvent, render, screen } from "@testing-library/react";
+import { resetMockConvexQueries, setMockQueryResult } from "convex/react";
+
+const mockOpenInSidebar = jest.fn();
+const mockHandleKeyDown = jest.fn();
+const mockCapture = jest.fn();
+
+jest.mock("@/app/hooks/useToolSidebar", () => ({
+  useToolSidebar: () => ({
+    handleOpenInSidebar: mockOpenInSidebar,
+    handleKeyDown: mockHandleKeyDown,
+    isSidebarActive: false,
+  }),
+}));
+
+jest.mock("@/lib/analytics/client", () => ({
+  captureAuthenticatedEvent: mockCapture,
+}));
+
+const { FindingToolHandler } =
+  require("../FindingToolHandler") as typeof import("../FindingToolHandler");
+
+const successPart = {
+  toolCallId: "tool-1",
+  state: "output-available",
+  input: { title: "Confirmed IDOR", target: "app.example.test" },
+  output: {
+    success: true,
+    finding_id: "finding-1",
+    title: "Confirmed IDOR",
+    target: "app.example.test",
+    endpoint: "/api/invoices/other",
+    severity: "high",
+    cvss_score: 7.1,
+  },
+};
+
+describe("FindingToolHandler", () => {
+  beforeEach(() => {
+    resetMockConvexQueries();
+    jest.clearAllMocks();
+  });
+
+  it("renders streaming input and available input states", () => {
+    const { rerender } = render(
+      <FindingToolHandler
+        status="streaming"
+        part={{ toolCallId: "tool-1", state: "input-streaming" }}
+      />,
+    );
+    expect(screen.getByText("Preparing vulnerability report")).toBeVisible();
+
+    rerender(
+      <FindingToolHandler
+        status="streaming"
+        part={{
+          toolCallId: "tool-1",
+          state: "input-available",
+          input: { title: "Confirmed IDOR" },
+        }}
+      />,
+    );
+    expect(screen.getByText("Saving confirmed finding")).toBeVisible();
+    expect(screen.getByText("Confirmed IDOR")).toBeVisible();
+  });
+
+  it("renders a saved card, preserves it across remount, and opens on click", () => {
+    setMockQueryResult(undefined);
+    const first = render(
+      <FindingToolHandler status="ready" part={successPart} />,
+    );
+    expect(screen.getByText("Confirmed IDOR")).toBeVisible();
+    expect(screen.getByText("/api/invoices/other")).toBeVisible();
+    expect(screen.getByText(/high · 7\.1/i)).toBeVisible();
+
+    fireEvent.click(
+      screen.getByRole("button", { name: "Open finding: Confirmed IDOR" }),
+    );
+    expect(mockOpenInSidebar).toHaveBeenCalledTimes(1);
+    expect(mockCapture).toHaveBeenCalledWith("finding_viewed", {
+      surface: "inline_card",
+    });
+
+    first.unmount();
+    render(<FindingToolHandler status="ready" part={successPart} />);
+    expect(screen.getByText("Confirmed IDOR")).toBeVisible();
+  });
+
+  it.each(["validation", "general"])(
+    "shows safe, expandable details for %s failures",
+    (error) => {
+      render(
+        <FindingToolHandler
+          status="ready"
+          part={{
+            toolCallId: "tool-1",
+            state: "output-available",
+            output: { success: false, error, message: "Private raw error" },
+          }}
+        />,
+      );
+      expect(
+        screen.getByText("Vulnerability report wasn’t saved"),
+      ).toBeVisible();
+      expect(screen.getByText("View details")).toBeVisible();
+      expect(screen.queryByText("Private raw error")).not.toBeInTheDocument();
+
+      fireEvent.click(
+        screen.getByRole("button", {
+          name: "Open vulnerability report error details",
+        }),
+      );
+      expect(mockOpenInSidebar).toHaveBeenCalledTimes(1);
+
+      fireEvent.keyDown(
+        screen.getByRole("button", {
+          name: "Open vulnerability report error details",
+        }),
+        { key: "Escape" },
+      );
+      expect(mockHandleKeyDown).toHaveBeenCalledTimes(1);
+    },
+  );
+
+  it("shows duplicate failures without opening error details", () => {
+    render(
+      <FindingToolHandler
+        status="ready"
+        part={{
+          toolCallId: "tool-1",
+          state: "output-available",
+          output: {
+            success: false,
+            error: "duplicate",
+            message: "Already saved in this chat",
+          },
+        }}
+      />,
+    );
+    expect(screen.getByText("Duplicate finding rejected")).toBeVisible();
+    expect(screen.getByText("Already saved in this chat")).toBeVisible();
+    expect(screen.queryByRole("button")).not.toBeInTheDocument();
+  });
+
+  it("never exposes framework validation payloads inline", () => {
+    const rawError =
+      'Invalid input for tool create_vulnerability_report: Type validation failed: Value: {"poc_script_code":"private exploit"}';
+    render(
+      <FindingToolHandler
+        status="ready"
+        part={{
+          toolCallId: "tool-1",
+          state: "output-error",
+          errorText: rawError,
+        }}
+      />,
+    );
+    expect(screen.getByText("Vulnerability report wasn’t saved")).toBeVisible();
+    expect(screen.getByText("View details")).toBeVisible();
+    expect(screen.queryByText(rawError)).not.toBeInTheDocument();
+    expect(screen.queryByText(/private exploit/i)).not.toBeInTheDocument();
+  });
+
+  it("reactively replaces a card with the deleted state", () => {
+    setMockQueryResult(undefined);
+    const { rerender } = render(
+      <FindingToolHandler status="ready" part={successPart} />,
+    );
+    expect(screen.getByText("Confirmed IDOR")).toBeVisible();
+
+    setMockQueryResult(null);
+    rerender(<FindingToolHandler status="ready" part={{ ...successPart }} />);
+    expect(screen.getByText("Finding deleted")).toBeVisible();
+    expect(
+      screen.queryByRole("button", { name: /Open finding/i }),
+    ).not.toBeInTheDocument();
+  });
+});
diff --git a/app/components/tools/__tests__/ToolErrorDetail.test.tsx b/app/components/tools/__tests__/ToolErrorDetail.test.tsx
new file mode 100644
index 000000000..f78596261
--- /dev/null
+++ b/app/components/tools/__tests__/ToolErrorDetail.test.tsx
@@ -0,0 +1,29 @@
+import "@testing-library/jest-dom";
+import { render, screen } from "@testing-library/react";
+import { ToolErrorDetail } from "../ToolErrorDetail";
+import { createToolInputErrorContent } from "@/lib/chat/tool-error-display";
+
+describe("ToolErrorDetail", () => {
+  it("explains the failure and next step without showing raw parameters", () => {
+    const content = createToolInputErrorContent({
+      toolType: "tool-create_vulnerability_report",
+      toolCallId: "finding-call",
+      errorText:
+        'Invalid input for tool create_vulnerability_report: Value: {"cve":"private"}. Error message: [{"code":"invalid_format","path":["cve"],"message":"private"}]',
+    });
+
+    render(<ToolErrorDetail content={content} />);
+
+    expect(screen.getByText("What happened")).toBeVisible();
+    expect(screen.getByText("What to do next")).toBeVisible();
+    expect(
+      screen.getByText("The vulnerability report wasn’t saved"),
+    ).toBeVisible();
+    expect(screen.getByText(/No finding was saved/)).toBeVisible();
+    expect(screen.getByText("CVE")).toBeVisible();
+    expect(screen.getByText("Invalid format")).toBeVisible();
+    expect(screen.getByText(/raw validation data are not shown/)).toBeVisible();
+    expect(screen.queryByText(/Value:/)).not.toBeInTheDocument();
+    expect(screen.queryByText("private")).not.toBeInTheDocument();
+  });
+});
diff --git a/app/components/tools/__tests__/shell-tool-utils.test.ts b/app/components/tools/__tests__/shell-tool-utils.test.ts
index 953c7bb0c..eee3d94c5 100644
--- a/app/components/tools/__tests__/shell-tool-utils.test.ts
+++ b/app/components/tools/__tests__/shell-tool-utils.test.ts
@@ -35,12 +35,15 @@ describe("terminal shell tool display helpers", () => {
 
     expect(result.blockAction(false)).toBe("Invalid command");
     expect(result.blockTarget).toBe("Invalid command");
-    expect(result.finalOutput).toBe(validationError);
+    expect(result.finalOutput).toBe(
+      "Some tool parameters did not match the required format.",
+    );
     expect(result.sidebarContent).toMatchObject({
       command: "Invalid command",
-      output: validationError,
+      output: "Some tool parameters did not match the required format.",
       toolCallId: "call-empty",
     });
+    expect(JSON.stringify(result.sidebarContent)).not.toContain("Value: {}.");
   });
 
   it("keeps non-validation empty terminal failures label-consistent", () => {
diff --git a/app/components/tools/shell-tool-utils.ts b/app/components/tools/shell-tool-utils.ts
index 9efa04a5b..3dd9f049b 100644
--- a/app/components/tools/shell-tool-utils.ts
+++ b/app/components/tools/shell-tool-utils.ts
@@ -6,6 +6,10 @@
  */
 
 import type { SidebarTerminal } from "@/types/chat";
+import {
+  getSafeToolErrorText,
+  isToolInputValidationError as isToolInputValidationErrorValue,
+} from "@/lib/chat/tool-error-display";
 
 // ---------------------------------------------------------------------------
 // Types
@@ -111,11 +115,7 @@ export function getShellDisplayCommand(
 }
 
 export function isToolInputValidationError(errorText?: string): boolean {
-  if (!errorText) return false;
-  return (
-    errorText.includes("Invalid input for tool") ||
-    errorText.includes("Type validation failed")
-  );
+  return isToolInputValidationErrorValue(errorText);
 }
 
 export function getTerminalFailureAction(errorText?: string): string {
@@ -268,7 +268,7 @@ export function getShellOutput(
     extra?.streamingOutput ||
     (result?.error ?? "") ||
     (typeof output?.error === "string" ? output.error : "") ||
-    extra?.errorText ||
+    getSafeToolErrorText(extra?.errorText, "") ||
     ""
   );
 }
diff --git a/app/globals.css b/app/globals.css
index e50f817d1..174552dfd 100644
--- a/app/globals.css
+++ b/app/globals.css
@@ -230,12 +230,46 @@
   contain-intrinsic-size: auto 180px;
 }
 
+@keyframes source-message-arrival {
+  0% {
+    opacity: 0;
+  }
+  12%,
+  45% {
+    opacity: 1;
+  }
+  100% {
+    opacity: 0;
+  }
+}
+
+.source-message-highlight {
+  position: relative;
+  outline: none;
+}
+
+.source-message-highlight::after {
+  position: absolute;
+  inset: -0.375rem;
+  border-radius: calc(1rem + 0.375rem);
+  background-color: color-mix(in srgb, var(--link-color) 7%, transparent);
+  box-shadow: 0 0 1.5rem color-mix(in srgb, var(--link-color) 10%, transparent);
+  content: "";
+  opacity: 0;
+  pointer-events: none;
+  animation: source-message-arrival 2400ms cubic-bezier(0.16, 1, 0.3, 1);
+}
+
 @media (prefers-reduced-motion: reduce) {
   .worked-for-content[data-state="open"],
   .worked-for-content[data-state="closed"] {
     animation-duration: 1ms;
     transform: none;
   }
+
+  .source-message-highlight::after {
+    animation: none;
+  }
 }
 
 /* Scrollbar Styles */
diff --git a/app/hooks/__tests__/useSourceMessageNavigation.test.tsx b/app/hooks/__tests__/useSourceMessageNavigation.test.tsx
new file mode 100644
index 000000000..aa97ef667
--- /dev/null
+++ b/app/hooks/__tests__/useSourceMessageNavigation.test.tsx
@@ -0,0 +1,167 @@
+import "@testing-library/jest-dom";
+import { afterEach, describe, expect, it, jest } from "@jest/globals";
+import { act, renderHook, waitFor } from "@testing-library/react";
+import { useSourceMessageNavigation } from "../useSourceMessageNavigation";
+import { getChatMessageElementId } from "@/lib/findings/source-message";
+import { STICKY_BOTTOM_ESCAPE_EVENT } from "@/lib/utils/scroll-events";
+
+const mockReducedMotion = (matches: boolean) => {
+  jest.mocked(window.matchMedia).mockImplementation((query) => ({
+    matches: matches && query === "(prefers-reduced-motion: reduce)",
+    media: query,
+    onchange: null,
+    addListener: jest.fn(),
+    removeListener: jest.fn(),
+    addEventListener: jest.fn(),
+    removeEventListener: jest.fn(),
+    dispatchEvent: jest.fn(),
+  }));
+};
+
+describe("useSourceMessageNavigation", () => {
+  afterEach(() => {
+    window.history.replaceState(null, "", "/");
+    document.body.replaceChildren();
+    jest.restoreAllMocks();
+    mockReducedMotion(false);
+  });
+
+  it("scrolls to and focuses the source message from the URL fragment", async () => {
+    window.history.replaceState(null, "", "/c/chat-1#message=message-1");
+    const requestAnimationFrame = jest
+      .spyOn(window, "requestAnimationFrame")
+      .mockImplementation((callback) => {
+        callback(0);
+        return 1;
+      });
+    const target = document.createElement("div");
+    target.id = getChatMessageElementId("message-1");
+    target.tabIndex = -1;
+    const scrollIntoView = jest.fn();
+    target.scrollIntoView = scrollIntoView;
+    const focus = jest.spyOn(target, "focus");
+    document.body.appendChild(target);
+    const escapeStickyBottom = jest.fn();
+    window.addEventListener(STICKY_BOTTOM_ESCAPE_EVENT, escapeStickyBottom);
+
+    const { result } = renderHook(() =>
+      useSourceMessageNavigation({
+        loadedMessageCount: 1,
+        paginationStatus: "Exhausted",
+      }),
+    );
+
+    await waitFor(() => {
+      expect(result.current).toBe("message-1");
+      expect(scrollIntoView).toHaveBeenCalledWith({
+        behavior: "smooth",
+        block: "start",
+      });
+      expect(target).toHaveFocus();
+      expect(focus).toHaveBeenCalledWith({ preventScroll: true });
+      expect(focus.mock.invocationCallOrder[0]).toBeLessThan(
+        scrollIntoView.mock.invocationCallOrder[0],
+      );
+      expect(escapeStickyBottom).toHaveBeenCalledTimes(1);
+    });
+    expect(requestAnimationFrame).toHaveBeenCalledTimes(2);
+
+    window.removeEventListener(STICKY_BOTTOM_ESCAPE_EVENT, escapeStickyBottom);
+  });
+
+  it("avoids smooth scrolling when reduced motion is requested", async () => {
+    window.history.replaceState(null, "", "/c/chat-1#message=message-1");
+    jest
+      .spyOn(window, "requestAnimationFrame")
+      .mockImplementation((callback) => {
+        callback(0);
+        return 1;
+      });
+    mockReducedMotion(true);
+    const target = document.createElement("div");
+    target.id = getChatMessageElementId("message-1");
+    target.tabIndex = -1;
+    target.scrollIntoView = jest.fn();
+    document.body.appendChild(target);
+
+    renderHook(() =>
+      useSourceMessageNavigation({
+        loadedMessageCount: 1,
+        paginationStatus: "Exhausted",
+      }),
+    );
+
+    await waitFor(() => {
+      expect(target.scrollIntoView).toHaveBeenCalledWith({
+        behavior: "auto",
+        block: "start",
+      });
+    });
+  });
+
+  it("keeps loading when a page adds only hidden messages", async () => {
+    window.history.replaceState(null, "", "/c/chat-1#message=message-older");
+    const loadMore = jest.fn();
+    let loadedMessageCount = 1;
+    let paginationStatus: "CanLoadMore" | "LoadingMore" | "Exhausted" =
+      "CanLoadMore";
+
+    const { rerender } = renderHook(() =>
+      useSourceMessageNavigation({
+        loadedMessageCount,
+        paginationStatus,
+        loadMore,
+      }),
+    );
+
+    await waitFor(() => expect(loadMore).toHaveBeenCalledWith(28));
+    rerender();
+    expect(loadMore).toHaveBeenCalledTimes(1);
+
+    paginationStatus = "LoadingMore";
+    rerender();
+    expect(loadMore).toHaveBeenCalledTimes(1);
+
+    loadedMessageCount = 2;
+    paginationStatus = "CanLoadMore";
+    rerender();
+    await waitFor(() => expect(loadMore).toHaveBeenCalledTimes(2));
+
+    const target = document.createElement("div");
+    target.id = getChatMessageElementId("message-older");
+    target.tabIndex = -1;
+    target.scrollIntoView = jest.fn();
+    document.body.appendChild(target);
+    loadedMessageCount = 3;
+    paginationStatus = "Exhausted";
+    rerender();
+
+    await waitFor(() => expect(target).toHaveFocus());
+  });
+
+  it("responds to a source-message hash change without a page reload", async () => {
+    const target = document.createElement("div");
+    target.id = getChatMessageElementId("message-2");
+    target.tabIndex = -1;
+    target.scrollIntoView = jest.fn();
+    document.body.appendChild(target);
+
+    const { result } = renderHook(() =>
+      useSourceMessageNavigation({
+        loadedMessageCount: 1,
+        paginationStatus: "Exhausted",
+      }),
+    );
+    expect(result.current).toBeNull();
+
+    act(() => {
+      window.history.replaceState(null, "", "/c/chat-1#message=message-2");
+      window.dispatchEvent(new HashChangeEvent("hashchange"));
+    });
+
+    await waitFor(() => {
+      expect(result.current).toBe("message-2");
+      expect(target).toHaveFocus();
+    });
+  });
+});
diff --git a/app/hooks/useSidebarNavigation.ts b/app/hooks/useSidebarNavigation.ts
index 36a1612f2..03e4cfbae 100644
--- a/app/hooks/useSidebarNavigation.ts
+++ b/app/hooks/useSidebarNavigation.ts
@@ -9,6 +9,7 @@ import {
   isSidebarTerminal,
   isSidebarProxy,
   isSidebarWebSearch,
+  isSidebarFinding,
   type SidebarContent,
 } from "@/types/chat";
 
@@ -62,6 +63,9 @@ export const useSidebarNavigation = ({
       if (isSidebarWebSearch(item) && isSidebarWebSearch(sidebarContent)) {
         return item.toolCallId === sidebarContent.toolCallId;
       }
+      if (isSidebarFinding(item) && isSidebarFinding(sidebarContent)) {
+        return item.findingId === sidebarContent.findingId;
+      }
       return false;
     });
   }, [sidebarContent, toolExecutions]);
diff --git a/app/hooks/useSourceMessageNavigation.ts b/app/hooks/useSourceMessageNavigation.ts
new file mode 100644
index 000000000..b0c2f7727
--- /dev/null
+++ b/app/hooks/useSourceMessageNavigation.ts
@@ -0,0 +1,83 @@
+import { useEffect, useRef, useState } from "react";
+import {
+  getChatMessageElementId,
+  getSourceMessageIdFromHash,
+} from "@/lib/findings/source-message";
+import { STICKY_BOTTOM_ESCAPE_EVENT } from "@/lib/utils/scroll-events";
+
+type MessagePaginationStatus =
+  "LoadingFirstPage" | "CanLoadMore" | "LoadingMore" | "Exhausted";
+
+export function useSourceMessageNavigation({
+  loadedMessageCount,
+  paginationStatus,
+  loadMore,
+}: {
+  loadedMessageCount: number;
+  paginationStatus?: MessagePaginationStatus;
+  loadMore?: (numItems: number) => void;
+}) {
+  const [sourceMessageId, setSourceMessageId] = useState<string | null>(null);
+  const scrolledMessageIdRef = useRef<string | null>(null);
+  const requestedPageAtMessageCountRef = useRef<number | null>(null);
+
+  useEffect(() => {
+    const syncSourceMessage = () => {
+      setSourceMessageId(getSourceMessageIdFromHash(window.location.hash));
+    };
+
+    syncSourceMessage();
+    window.addEventListener("hashchange", syncSourceMessage);
+    return () => window.removeEventListener("hashchange", syncSourceMessage);
+  }, []);
+
+  useEffect(() => {
+    if (!sourceMessageId) {
+      scrolledMessageIdRef.current = null;
+      requestedPageAtMessageCountRef.current = null;
+      return;
+    }
+
+    const target = document.getElementById(
+      getChatMessageElementId(sourceMessageId),
+    );
+    if (target) {
+      if (scrolledMessageIdRef.current === sourceMessageId) return;
+
+      target.dispatchEvent(
+        new CustomEvent(STICKY_BOTTOM_ESCAPE_EVENT, { bubbles: true }),
+      );
+      target.focus({ preventScroll: true });
+      let scrollFrame: number | null = null;
+      const layoutFrame = window.requestAnimationFrame(() => {
+        scrollFrame = window.requestAnimationFrame(() => {
+          if (!target.isConnected) return;
+          scrolledMessageIdRef.current = sourceMessageId;
+          target.scrollIntoView?.({
+            behavior: window.matchMedia("(prefers-reduced-motion: reduce)")
+              .matches
+              ? "auto"
+              : "smooth",
+            block: "start",
+          });
+        });
+      });
+
+      return () => {
+        window.cancelAnimationFrame(layoutFrame);
+        if (scrollFrame !== null) window.cancelAnimationFrame(scrollFrame);
+      };
+    }
+
+    if (
+      paginationStatus === "CanLoadMore" &&
+      loadMore &&
+      requestedPageAtMessageCountRef.current !== loadedMessageCount
+    ) {
+      requestedPageAtMessageCountRef.current = loadedMessageCount;
+      loadMore(28);
+    }
+  }, [loadMore, loadedMessageCount, paginationStatus, sourceMessageId]);
+
+  return sourceMessageId;
+}
diff --git a/app/share/[shareId]/components/SharedMessagePartHandler.tsx b/app/share/[shareId]/components/SharedMessagePartHandler.tsx
index bb76cb9b4..b2eff3e0f 100644
--- a/app/share/[shareId]/components/SharedMessagePartHandler.tsx
+++ b/app/share/[shareId]/components/SharedMessagePartHandler.tsx
@@ -42,6 +42,12 @@ import {
 } from "@/app/components/tools/shell-tool-utils";
 import { PROXY_COMPLETED_LABELS } from "@/app/components/tools/ProxyToolHandler";
 import { isUserStoppedToolError } from "@/lib/chat/tool-abort-utils";
+import { FindingCard } from "@/app/components/findings/FindingCard";
+import { ToolErrorBlock } from "@/app/components/tools/ToolErrorHandler";
+import {
+  createToolInputErrorContent,
+  isToolInputValidationError,
+} from "@/lib/chat/tool-error-display";
 
 interface MessagePart {
   type: string;
@@ -51,7 +57,9 @@ interface MessagePart {
   input?: any;
   output?: any;
   toolCallId?: string;
+  toolName?: string;
   errorText?: string;
+  data?: any;
 }
 
 interface SharedMessagePartHandlerProps {
@@ -108,6 +116,37 @@ export const SharedMessagePartHandler = ({
     );
   }
 
+  if (part.type === "data-shared-finding" && part.data) {
+    return (
+      <FindingCard
+        title={part.data.title}
+        target={part.data.target}
+        severity={part.data.severity}
+        cvssScore={part.data.cvss_score}
+      />
+    );
+  }
+
+  const validationToolType = part.type.startsWith("tool-")
+    ? part.type
+    : part.type === "dynamic-tool" && typeof part.toolName === "string"
+      ? `tool-${part.toolName}`
+      : null;
+  if (
+    validationToolType &&
+    part.state === "output-error" &&
+    isToolInputValidationError(part.errorText)
+  ) {
+    const content = createToolInputErrorContent({
+      toolType: validationToolType,
+      toolCallId: part.toolCallId || "",
+      errorText: part.errorText,
+    });
+    return (
+      <ToolErrorBlock content={content} onOpen={() => openSidebar(content)} />
+    );
+  }
+
   // Terminal commands
   if (
     part.type === "data-terminal" ||
diff --git a/components/ui/__tests__/tool-block.test.tsx b/components/ui/__tests__/tool-block.test.tsx
new file mode 100644
index 000000000..2837e1e68
--- /dev/null
+++ b/components/ui/__tests__/tool-block.test.tsx
@@ -0,0 +1,31 @@
+import "@testing-library/jest-dom";
+import { fireEvent, render, screen } from "@testing-library/react";
+import ToolBlock from "../tool-block";
+
+describe("ToolBlock", () => {
+  it("renders status-only blocks without an inert button", () => {
+    render(<ToolBlock icon={<span>icon</span>} action="Preparing report" />);
+
+    expect(screen.getByText("Preparing report")).toBeVisible();
+    expect(screen.queryByRole("button")).not.toBeInTheDocument();
+  });
+
+  it("uses a semantic button and explicit accessible label when clickable", () => {
+    const onClick = jest.fn();
+    render(
+      <ToolBlock
+        icon={<span>icon</span>}
+        action="Tool input needs attention"
+        target="View details"
+        isClickable
+        onClick={onClick}
+        ariaLabel="Open terminal error details"
+      />,
+    );
+
+    fireEvent.click(
+      screen.getByRole("button", { name: "Open terminal error details" }),
+    );
+    expect(onClick).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/components/ui/dialog.tsx b/components/ui/dialog.tsx
index d5b4ccbde..0ad0d349c 100644
--- a/components/ui/dialog.tsx
+++ b/components/ui/dialog.tsx
@@ -50,13 +50,15 @@ function DialogContent({
   className,
   children,
   showCloseButton = true,
+  overlayClassName,
   ...props
 }: React.ComponentProps<typeof DialogPrimitive.Content> & {
   showCloseButton?: boolean;
+  overlayClassName?: string;
 }) {
   return (
     <DialogPortal data-slot="dialog-portal">
-      <DialogOverlay />
+      <DialogOverlay className={overlayClassName} />
       <DialogPrimitive.Content
         data-slot="dialog-content"
         className={cn(
diff --git a/components/ui/radio-group.tsx b/components/ui/radio-group.tsx
index bc5495a5a..c4d4477ec 100644
--- a/components/ui/radio-group.tsx
+++ b/components/ui/radio-group.tsx
@@ -27,7 +27,7 @@ function RadioGroupItem({
     <RadioGroupPrimitive.Item
       data-slot="radio-group-item"
       className={cn(
-        "border-input text-primary focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive dark:bg-input/30 aspect-square size-4 shrink-0 rounded-full border shadow-xs transition-[color,box-shadow] outline-none focus-visible:ring-[3px] disabled:cursor-not-allowed disabled:opacity-50",
+        "border-input focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive dark:bg-input/30 aspect-square size-4 shrink-0 rounded-full border shadow-xs transition-[color,box-shadow] outline-none focus-visible:ring-[3px] disabled:cursor-not-allowed disabled:opacity-50",
         className,
       )}
       {...props}
@@ -36,7 +36,7 @@ function RadioGroupItem({
         data-slot="radio-group-indicator"
         className="relative flex items-center justify-center"
       >
-        <CircleIcon className="fill-primary absolute top-1/2 left-1/2 size-2 -translate-x-1/2 -translate-y-1/2" />
+        <CircleIcon className="absolute top-1/2 left-1/2 size-2 -translate-x-1/2 -translate-y-1/2 fill-current" />
       </RadioGroupPrimitive.Indicator>
     </RadioGroupPrimitive.Item>
   );
diff --git a/components/ui/tool-block.tsx b/components/ui/tool-block.tsx
index 9418bede3..9c5b5130d 100644
--- a/components/ui/tool-block.tsx
+++ b/components/ui/tool-block.tsx
@@ -9,6 +9,7 @@ interface ToolBlockProps {
   isClickable?: boolean;
   onClick?: () => void;
   onKeyDown?: (e: React.KeyboardEvent) => void;
+  ariaLabel?: string;
 }
 
 const ToolBlock: React.FC<ToolBlockProps> = ({
@@ -19,6 +20,7 @@ const ToolBlock: React.FC<ToolBlockProps> = ({
   isClickable = false,
   onClick,
   onKeyDown,
+  ariaLabel,
 }) => {
   const baseClasses =
     "rounded-[15px] px-[10px] py-[6px] border border-border bg-muted/20 inline-flex max-w-full gap-[4px] items-center relative h-[36px] overflow-hidden";
@@ -26,32 +28,41 @@ const ToolBlock: React.FC<ToolBlockProps> = ({
     ? "cursor-pointer hover:bg-muted/40 transition-colors"
     : "";
 
+  const content = (
+    <>
+      <div className="w-[21px] inline-flex items-center flex-shrink-0 text-foreground [&>svg]:h-4 [&>svg]:w-4">
+        {icon}
+      </div>
+      <div className="max-w-[100%] truncate text-muted-foreground relative top-[-1px]">
+        <span className="text-[13px]">
+          {isShimmer ? <Shimmer>{action}</Shimmer> : action}
+        </span>
+        {target && (
+          <span className="text-[12px] font-mono ml-[6px] text-muted-foreground/70">
+            {target}
+          </span>
+        )}
+      </div>
+    </>
+  );
+
   return (
     <div className="flex-1 min-w-0">
-      <button
-        className={`${baseClasses} ${clickableClasses}`}
-        onClick={isClickable ? onClick : undefined}
-        onKeyDown={isClickable ? onKeyDown : undefined}
-        tabIndex={isClickable ? 0 : undefined}
-        role={isClickable ? "button" : undefined}
-        aria-label={
-          isClickable && target ? `Open ${target} in sidebar` : undefined
-        }
-      >
-        <div className="w-[21px] inline-flex items-center flex-shrink-0 text-foreground [&>svg]:h-4 [&>svg]:w-4">
-          {icon}
-        </div>
-        <div className="max-w-[100%] truncate text-muted-foreground relative top-[-1px]">
-          <span className="text-[13px]">
-            {isShimmer ? <Shimmer>{action}</Shimmer> : action}
-          </span>
-          {target && (
-            <span className="text-[12px] font-mono ml-[6px] text-muted-foreground/70">
-              {target}
-            </span>
-          )}
-        </div>
-      </button>
+      {isClickable ? (
+        <button
+          type="button"
+          className={`${baseClasses} ${clickableClasses}`}
+          onClick={onClick}
+          onKeyDown={onKeyDown}
+          aria-label={
+            ariaLabel || (target ? `Open ${target} in sidebar` : undefined)
+          }
+        >
+          {content}
+        </button>
+      ) : (
+        <div className={baseClasses}>{content}</div>
+      )}
     </div>
   );
 };
diff --git a/convex/__tests__/chats.agentApprovalLifecycle.test.ts b/convex/__tests__/chats.agentApprovalLifecycle.test.ts
index f417818eb..296ce1e2e 100644
--- a/convex/__tests__/chats.agentApprovalLifecycle.test.ts
+++ b/convex/__tests__/chats.agentApprovalLifecycle.test.ts
@@ -34,7 +34,11 @@ jest.mock("convex/server", () => ({
 }));
 
 jest.mock("../_generated/api", () => ({
-  internal: { chats: {}, redisPubsub: {}, s3Cleanup: {} },
+  internal: {
+    chats: { deleteAllChatsBatch: "internal.chats.deleteAllChatsBatch" },
+    redisPubsub: {},
+    s3Cleanup: {},
+  },
 }));
 
 jest.mock("../fileAggregate", () => ({
@@ -55,6 +59,7 @@ jest.mock("../lib/suspensionGuards", () => ({
 
 const {
   deleteChatForBackend,
+  deleteAllChatsForUser,
   fenceChatsForDeletion,
   getActiveTriggerRunsForUser,
   setActiveTriggerRun,
@@ -94,6 +99,146 @@ describe("Agent approval lifecycle guards", () => {
     expect(patch).not.toHaveBeenCalled();
   });
 
+  it("cascades structured findings before deleting their source chat", async () => {
+    const tables: Record<string, Array<Record<string, any>>> = {
+      chats: [
+        {
+          _id: "chat-doc-1",
+          id: "chat-1",
+          user_id: "user-1",
+          canceled_at: 1,
+        },
+      ],
+      findings: [
+        {
+          _id: "finding-doc-1",
+          user_id: "user-1",
+          chat_id: "chat-1",
+          created_at: 1,
+        },
+      ],
+      finding_sources: [
+        {
+          _id: "finding-source-1",
+          user_id: "user-1",
+          chat_id: "chat-1",
+        },
+      ],
+      messages: [],
+      chat_summaries: [],
+    };
+    const deleted: string[] = [];
+    const db = {
+      query: jest.fn((table: string) => ({
+        withIndex: jest.fn((_index: string, build: (q: any) => any) => {
+          const filters: Array<[string, unknown]> = [];
+          const q: any = {
+            eq: (field: string, value: unknown) => {
+              filters.push([field, value]);
+              return q;
+            },
+          };
+          build(q);
+          const rows = () =>
+            (tables[table] ?? []).filter((row) =>
+              filters.every(([field, value]) => row[field] === value),
+            );
+          return {
+            first: jest.fn(async () => rows()[0] ?? null),
+            unique: jest.fn(async () => rows()[0] ?? null),
+            take: jest.fn(async (limit: number) => rows().slice(0, limit)),
+          };
+        }),
+      })),
+      patch: jest.fn().mockResolvedValue(undefined),
+      delete: jest.fn(async (id: string) => {
+        deleted.push(id);
+        for (const [table, rows] of Object.entries(tables)) {
+          tables[table] = rows.filter((row) => row._id !== id);
+        }
+      }),
+    };
+
+    await expect(
+      deleteChatForBackend.handler(
+        { db, scheduler: { runAfter: jest.fn() } } as any,
+        {
+          serviceKey: "service-key",
+          chatId: "chat-1",
+          userId: "user-1",
+          expectedTriggerRunId: null,
+          expectedApprovalSessionId: null,
+        },
+      ),
+    ).resolves.toBe("deleted");
+
+    expect(deleted).toEqual([
+      "finding-doc-1",
+      "finding-source-1",
+      "chat-doc-1",
+    ]);
+  });
+
+  it("uses bounded continuation batches for service-key test cleanup", async () => {
+    const chat = {
+      _id: "chat-doc-1",
+      id: "chat-1",
+      user_id: "user-1",
+      canceled_at: 1,
+    };
+    const findings = Array.from({ length: 26 }, (_, index) => ({
+      _id: `finding-doc-${index + 1}`,
+      user_id: "user-1",
+      chat_id: "chat-1",
+      created_at: index + 1,
+    }));
+    const deleteDoc = jest.fn<any>().mockResolvedValue(undefined);
+    const runAfter = jest.fn<any>().mockResolvedValue(undefined);
+    const db = {
+      query: jest.fn((table: string) => ({
+        withIndex: jest.fn((_index: string, build: (q: any) => any) => {
+          const filters: Array<[string, unknown]> = [];
+          const q: any = {
+            eq: (field: string, value: unknown) => {
+              filters.push([field, value]);
+              return q;
+            },
+          };
+          build(q);
+          const rows = table === "chats" ? [chat] : findings;
+          const filtered = rows.filter((row) =>
+            filters.every(
+              ([field, value]) => row[field as keyof typeof row] === value,
+            ),
+          );
+          return {
+            first: jest.fn(async () => filtered[0] ?? null),
+            take: jest.fn(async (limit: number) => filtered.slice(0, limit)),
+          };
+        }),
+      })),
+      delete: deleteDoc,
+      patch: jest.fn<any>().mockResolvedValue(undefined),
+    };
+
+    await expect(
+      deleteAllChatsForUser.handler({ db, scheduler: { runAfter } } as any, {
+        serviceKey: "service-key",
+        userId: "user-1",
+      }),
+    ).resolves.toBeNull();
+
+    expect(deleteDoc).toHaveBeenCalledTimes(25);
+    expect(deleteDoc).not.toHaveBeenCalledWith("chat-doc-1");
+    expect(runAfter).toHaveBeenCalledWith(
+      0,
+      "internal.chats.deleteAllChatsBatch",
+      {
+        userId: "user-1",
+      },
+    );
+  });
+
   it("does not attach a new run after chat deletion starts", async () => {
     const { ctx, patch } = makeCtx({
       _id: "chat-doc-1",
diff --git a/convex/__tests__/findings.shared-security.test.ts b/convex/__tests__/findings.shared-security.test.ts
new file mode 100644
index 000000000..ed71eabf7
--- /dev/null
+++ b/convex/__tests__/findings.shared-security.test.ts
@@ -0,0 +1,177 @@
+import { beforeEach, describe, expect, it, jest } from "@jest/globals";
+
+jest.mock("../_generated/server", () => ({
+  mutation: jest.fn((config: any) => config),
+  query: jest.fn((config: any) => config),
+  internalQuery: jest.fn((config: any) => config),
+}));
+
+jest.mock("convex/values", () => {
+  const actual =
+    jest.requireActual<typeof import("convex/values")>("convex/values");
+  return {
+    ...actual,
+    v: new Proxy({}, { get: () => jest.fn(() => "validator") }),
+  };
+});
+
+jest.mock("convex/server", () => ({
+  paginationOptsValidator: "paginationOptsValidator",
+}));
+
+jest.mock("../_generated/api", () => ({
+  internal: {
+    messages: {},
+    s3Cleanup: {},
+  },
+}));
+
+jest.mock("../lib/utils", () => ({
+  validateServiceKey: jest.fn(),
+  copyChatSummary: jest.fn(),
+}));
+
+jest.mock("../lib/suspensionGuards", () => ({
+  CHAT_ACCESS_SUSPENDED_CODE: "CHAT_ACCESS_SUSPENDED",
+  assertUserCanAccessChatHistory: jest.fn<any>().mockResolvedValue(undefined),
+  isUserBlockedByActiveFraudDispute: jest.fn<any>().mockResolvedValue(false),
+}));
+
+jest.mock("../fileAggregate", () => ({
+  fileCountAggregate: {
+    deleteIfExists: jest.fn<any>().mockResolvedValue(undefined),
+  },
+}));
+
+jest.mock("../lib/logger", () => ({
+  convexLogger: {
+    warn: jest.fn(),
+    info: jest.fn(),
+    error: jest.fn(),
+  },
+}));
+
+const CHAT_ID = "11111111-1111-4111-8111-111111111111";
+const SHARE_ID = "22222222-2222-4222-8222-222222222222";
+
+const privateFindingPart = {
+  type: "tool-create_vulnerability_report",
+  toolCallId: "tool-secret",
+  state: "output-available",
+  input: {
+    title: "Confirmed IDOR",
+    target: "app.example.test",
+    evidence: "private evidence",
+    technical_analysis: "private analysis",
+    poc_script_code: "private exploit",
+    cve: "CVE-2026-12345",
+    cwe: "CWE-639",
+    code_locations: [{ file: "private.ts" }],
+  },
+  output: {
+    success: true,
+    finding_id: "finding-secret",
+    title: "Confirmed IDOR",
+    target: "app.example.test",
+    severity: "high",
+    cvss_score: 7.1,
+  },
+};
+
+const safeFindingPart = {
+  type: "data-shared-finding",
+  data: {
+    title: "Confirmed IDOR",
+    target: "app.example.test",
+    severity: "high",
+    cvss_score: 7.1,
+  },
+};
+
+const sourceChat = {
+  _id: "chat-doc-1",
+  id: CHAT_ID,
+  title: "Invoice test",
+  user_id: "owner-user",
+  share_id: SHARE_ID,
+  share_date: 2_000,
+};
+
+const sourceMessage = {
+  _id: "message-doc-1",
+  _creationTime: 1_000,
+  id: "message-1",
+  chat_id: CHAT_ID,
+  user_id: "owner-user",
+  role: "assistant" as const,
+  parts: [privateFindingPart],
+  update_time: 1_000,
+};
+
+function createSharedCtx({ authenticated = false } = {}) {
+  const insert = jest.fn<any>().mockResolvedValue("inserted-doc");
+  const query = jest.fn((table: string) => ({
+    withIndex: jest.fn(() => {
+      if (table === "chats") {
+        return { first: jest.fn<any>().mockResolvedValue(sourceChat) };
+      }
+      if (table === "messages") {
+        return {
+          order: jest.fn(() => ({
+            collect: jest.fn<any>().mockResolvedValue([sourceMessage]),
+          })),
+        };
+      }
+      throw new Error(`Unexpected table: ${table}`);
+    }),
+  }));
+
+  return {
+    ctx: {
+      auth: {
+        getUserIdentity: jest
+          .fn<any>()
+          .mockResolvedValue(authenticated ? { subject: "fork-user" } : null),
+      },
+      db: { query, insert },
+    } as any,
+    insert,
+  };
+}
+
+const expectNoPrivateFindingData = (value: unknown) => {
+  expect(JSON.stringify(value)).not.toMatch(
+    /tool-secret|finding-secret|private evidence|private analysis|private exploit|private\.ts|CVE|CWE/,
+  );
+};
+
+describe("shared finding security boundary", () => {
+  beforeEach(() => jest.clearAllMocks());
+
+  it("returns only safe compact finding metadata from public shared reads", async () => {
+    const { getSharedMessages } = await import("../messages");
+    const { ctx } = createSharedCtx();
+
+    const result = await getSharedMessages.handler(ctx, { chatId: CHAT_ID });
+
+    expect(result).toHaveLength(1);
+    expect(result[0].parts).toEqual([safeFindingPart]);
+    expectNoPrivateFindingData(result);
+  });
+
+  it("persists only safe compact finding metadata in shared-chat forks", async () => {
+    const { forkSharedChat } = await import("../sharedChats");
+    const { ctx, insert } = createSharedCtx({ authenticated: true });
+
+    await forkSharedChat.handler(ctx, { shareId: SHARE_ID });
+
+    const messageInsert = insert.mock.calls.find(
+      ([table]: [string]) => table === "messages",
+    );
+    expect(messageInsert).toBeDefined();
+    expect(messageInsert?.[1]).toEqual(
+      expect.objectContaining({ parts: [safeFindingPart] }),
+    );
+    expectNoPrivateFindingData(messageInsert?.[1]);
+  });
+});
diff --git a/convex/__tests__/findings.test.ts b/convex/__tests__/findings.test.ts
new file mode 100644
index 000000000..3d70f425c
--- /dev/null
+++ b/convex/__tests__/findings.test.ts
@@ -0,0 +1,762 @@
+import { beforeEach, describe, expect, it, jest } from "@jest/globals";
+
+jest.mock("../_generated/server", () => ({
+  mutation: jest.fn((config: any) => config),
+  query: jest.fn((config: any) => config),
+}));
+
+jest.mock("convex/values", () => {
+  const actual =
+    jest.requireActual<typeof import("convex/values")>("convex/values");
+  return {
+    ...actual,
+    v: new Proxy({}, { get: () => jest.fn(() => "validator") }),
+  };
+});
+
+jest.mock("convex/server", () => ({
+  paginationOptsValidator: "paginationOptsValidator",
+}));
+
+jest.mock("../lib/utils", () => ({
+  validateServiceKey: jest.fn(),
+}));
+
+jest.mock("../lib/suspensionGuards", () => ({
+  assertUserCanAccessChatHistory: jest.fn().mockResolvedValue(undefined),
+}));
+
+type Row = { _id: string; [key: string]: any };
+type Tables = Record<string, Row[]>;
+
+const report = (overrides: Record<string, unknown> = {}) => ({
+  title: "Cross-tenant invoice access",
+  description: "An authenticated user can read another user's invoice.",
+  impact: "A user can disclose another customer's billing address.",
+  target: "https://app.example.test",
+  endpoint: "/api/invoices/:id",
+  method: "get",
+  cwe: "CWE-639",
+  technical_analysis: "The handler loads by id without an owner check.",
+  poc_description: "Request user B's invoice while signed in as user A.",
+  poc_script_code: "curl -H 'Authorization: Bearer user-a' /api/invoices/b",
+  remediation_steps: "Scope the invoice query to the authenticated user.",
+  evidence: "The response returned user B's billing address.",
+  assumptions: "Both accounts are ordinary customer accounts.",
+  fix_effort: "low",
+  cvss_breakdown: {
+    attack_vector: "N",
+    attack_complexity: "L",
+    privileges_required: "L",
+    user_interaction: "N",
+    scope: "U",
+    confidentiality: "H",
+    integrity: "N",
+    availability: "N",
+  },
+  ...overrides,
+});
+
+const seedTables = (): Tables => ({
+  chats: [
+    {
+      _id: "chat-doc-1",
+      id: "chat-1",
+      user_id: "user-1",
+      title: "Invoice test",
+      update_time: 1,
+    },
+    {
+      _id: "chat-doc-2",
+      id: "chat-2",
+      user_id: "user-1",
+      title: "Retest",
+      update_time: 2,
+    },
+    {
+      _id: "chat-doc-other",
+      id: "chat-other",
+      user_id: "other-user",
+      title: "Private other chat",
+      update_time: 3,
+    },
+  ],
+  messages: [
+    {
+      _id: "message-doc-1",
+      id: "message-1",
+      chat_id: "chat-1",
+      user_id: "user-1",
+      role: "assistant",
+      parts: [
+        { type: "text", text: "Confirmed." },
+        {
+          type: "tool-create_vulnerability_report",
+          toolCallId: "tool-1",
+          state: "output-available",
+          input: report(),
+          output: { success: true, finding_id: "finding-public-1" },
+        },
+        { type: "text", text: "Saved." },
+      ],
+      update_time: 1,
+    },
+  ],
+  findings: [],
+  finding_sources: [],
+});
+
+function createResult(rows: Row[], filters: Array<[string, unknown]>) {
+  const filtered = () =>
+    rows.filter((row) =>
+      filters.every(([field, value]) => row[field] === value),
+    );
+  const result: any = {
+    first: jest.fn(async () => filtered()[0] ?? null),
+    unique: jest.fn(async () => {
+      const matches = filtered();
+      if (matches.length > 1) throw new Error("Expected a unique result");
+      return matches[0] ?? null;
+    }),
+    collect: jest.fn(async () => filtered()),
+    take: jest.fn(async (limit: number) => filtered().slice(0, limit)),
+    order: jest.fn((direction: "asc" | "desc") => {
+      rows = [...filtered()].sort((a, b) =>
+        direction === "desc"
+          ? (b.latest_finding_at ?? b.created_at ?? 0) -
+            (a.latest_finding_at ?? a.created_at ?? 0)
+          : (a.latest_finding_at ?? a.created_at ?? 0) -
+            (b.latest_finding_at ?? b.created_at ?? 0),
+      );
+      filters = [];
+      return result;
+    }),
+    filter: jest.fn((build: (q: any) => any) => {
+      const q: any = {
+        field: (field: string) => field,
+        eq: (field: string, value: unknown) => {
+          filters.push([field, value]);
+          return q;
+        },
+      };
+      build(q);
+      return result;
+    }),
+    paginate: jest.fn(
+      async ({
+        cursor,
+        numItems,
+      }: {
+        cursor: string | null;
+        numItems: number;
+      }) => {
+        const all = filtered();
+        const start = cursor ? Number(cursor) : 0;
+        const page = all.slice(start, start + numItems);
+        const next = start + page.length;
+        return {
+          page,
+          isDone: next >= all.length,
+          continueCursor: next >= all.length ? "" : String(next),
+        };
+      },
+    ),
+    async *[Symbol.asyncIterator]() {
+      for (const row of filtered()) yield row;
+    },
+  };
+  return result;
+}
+
+function createMockCtx(tables: Tables, subject = "user-1") {
+  let nextId = 1;
+  const indexes: string[] = [];
+  const query = jest.fn((table: string) => ({
+    withIndex: jest.fn((index: string, build: (q: any) => any) => {
+      indexes.push(index);
+      const filters: Array<[string, unknown]> = [];
+      const q: any = {
+        eq: (field: string, value: unknown) => {
+          filters.push([field, value]);
+          return q;
+        },
+      };
+      build(q);
+      return createResult(tables[table] ?? [], filters);
+    }),
+    withSearchIndex: jest.fn((_index: string, build: (q: any) => any) => {
+      const filters: Array<[string, unknown]> = [];
+      let search = "";
+      const q: any = {
+        search: (_field: string, value: string) => {
+          search = value.toLowerCase();
+          return q;
+        },
+        eq: (field: string, value: unknown) => {
+          filters.push([field, value]);
+          return q;
+        },
+      };
+      build(q);
+      const rows = (tables[table] ?? []).filter((row) =>
+        String(row.search_text ?? "")
+          .toLowerCase()
+          .includes(search),
+      );
+      return createResult(rows, filters);
+    }),
+  }));
+  const insert = jest.fn(async (table: string, value: Record<string, any>) => {
+    const row = { _id: `${table}-${nextId++}`, ...value };
+    (tables[table] ??= []).push(row);
+    return row._id;
+  });
+  const patch = jest.fn(async (id: string, value: Record<string, any>) => {
+    for (const rows of Object.values(tables)) {
+      const row = rows.find((candidate) => candidate._id === id);
+      if (row) Object.assign(row, value);
+    }
+  });
+  const deleteDoc = jest.fn(async (id: string) => {
+    for (const [table, rows] of Object.entries(tables)) {
+      tables[table] = rows.filter((candidate) => candidate._id !== id);
+    }
+  });
+
+  return {
+    ctx: {
+      auth: {
+        getUserIdentity: jest
+          .fn()
+          .mockResolvedValue(subject ? { subject } : null),
+      },
+      db: { query, insert, patch, delete: deleteDoc },
+    } as any,
+    insert,
+    patch,
+    deleteDoc,
+    indexes,
+  };
+}
+
+const createArgs = (overrides: Record<string, unknown> = {}) => ({
+  serviceKey: "service-key",
+  userId: "user-1",
+  chatId: "chat-1",
+  messageId: "message-1",
+  toolCallId: "tool-1",
+  report: report(),
+  ...overrides,
+});
+
+describe("findings Convex lifecycle", () => {
+  beforeEach(() => jest.clearAllMocks());
+
+  it("persists server-derived provenance, score, severity, search, and dedupe", async () => {
+    const { createFindingForBackend } = await import("../findings");
+    const tables = seedTables();
+    const { ctx, insert } = createMockCtx(tables);
+
+    const result = await createFindingForBackend.handler(ctx, createArgs());
+
+    expect(result).toMatchObject({
+      success: true,
+      title: "Cross-tenant invoice access",
+      target: "https://app.example.test",
+      endpoint: "/api/invoices/:id",
+      severity: "medium",
+      cvss_score: 6.5,
+    });
+    expect(insert).toHaveBeenCalledWith(
+      "findings",
+      expect.objectContaining({
+        user_id: "user-1",
+        chat_id: "chat-1",
+        message_id: "message-1",
+        tool_call_id: "tool-1",
+        method: "GET",
+        severity: "medium",
+        category: "access_control",
+        status: "active",
+        cvss_score: 6.5,
+        cvss_vector: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+        dedupe_key: expect.any(String),
+        search_text: expect.stringMatching(
+          /CWE-639[\s\S]*Access Control \/ IDOR/,
+        ),
+        created_at: expect.any(Number),
+        updated_at: expect.any(Number),
+      }),
+    );
+    expect(insert).toHaveBeenCalledWith("finding_sources", {
+      user_id: "user-1",
+      chat_id: "chat-1",
+      chat_title: "Invoice test",
+      finding_count: 1,
+      latest_finding_at: expect.any(Number),
+    });
+  });
+
+  it("rejects a missing, deleted, or foreign source chat", async () => {
+    const { createFindingForBackend } = await import("../findings");
+    const tables = seedTables();
+    const { ctx } = createMockCtx(tables);
+
+    await expect(
+      createFindingForBackend.handler(
+        ctx,
+        createArgs({ chatId: "missing-chat" }),
+      ),
+    ).resolves.toMatchObject({ success: false, error: "chat_not_found" });
+    await expect(
+      createFindingForBackend.handler(
+        ctx,
+        createArgs({ chatId: "chat-other" }),
+      ),
+    ).resolves.toMatchObject({ success: false, error: "chat_not_found" });
+    tables.chats[0].deletion_started_at = Date.now();
+    await expect(
+      createFindingForBackend.handler(ctx, createArgs()),
+    ).resolves.toMatchObject({ success: false, error: "chat_not_found" });
+  });
+
+  it("deduplicates normalized reports in one chat but permits another chat", async () => {
+    const { createFindingForBackend } = await import("../findings");
+    const tables = seedTables();
+    const { ctx } = createMockCtx(tables);
+
+    await createFindingForBackend.handler(ctx, createArgs());
+    const duplicate = await createFindingForBackend.handler(
+      ctx,
+      createArgs({
+        toolCallId: "tool-2",
+        report: report({
+          title: "  CROSS-TENANT   invoice access ",
+          target: "HTTPS://APP.EXAMPLE.TEST",
+          method: "GET",
+          cwe: "CWE-639",
+        }),
+      }),
+    );
+    const crossChat = await createFindingForBackend.handler(
+      ctx,
+      createArgs({
+        chatId: "chat-2",
+        messageId: "message-2",
+        toolCallId: "tool-3",
+      }),
+    );
+    const secondInSourceChat = await createFindingForBackend.handler(
+      ctx,
+      createArgs({
+        toolCallId: "tool-4",
+        report: report({ title: "Cross-tenant invoice modification" }),
+      }),
+    );
+
+    expect(duplicate).toMatchObject({ success: false, error: "duplicate" });
+    expect(crossChat).toMatchObject({ success: true });
+    expect(secondInSourceChat).toMatchObject({ success: true });
+    expect(tables.findings).toHaveLength(3);
+    expect(tables.finding_sources).toHaveLength(2);
+    expect(
+      tables.finding_sources.find((source) => source.chat_id === "chat-1"),
+    ).toMatchObject({ finding_count: 2 });
+  });
+
+  it("paginates newest-first and applies ownership, severity, chat, and search", async () => {
+    const { listFindings } = await import("../findings");
+    const tables = seedTables();
+    tables.findings = [
+      {
+        _id: "finding-old",
+        finding_id: "old",
+        user_id: "user-1",
+        chat_id: "chat-1",
+        title: "Old SQL injection",
+        target: "api.example.test",
+        category: "injection",
+        status: "active",
+        severity: "critical",
+        cvss_score: 9.8,
+        search_text: "Old SQL injection api.example.test CWE-89",
+        created_at: 10,
+      },
+      {
+        _id: "finding-new",
+        finding_id: "new",
+        user_id: "user-1",
+        chat_id: "chat-2",
+        title: "New IDOR",
+        target: "app.example.test",
+        category: "access_control",
+        status: "closed",
+        severity: "high",
+        cvss_score: 7.1,
+        search_text: "New IDOR app.example.test /invoices CWE-639",
+        created_at: 20,
+      },
+      {
+        _id: "finding-other",
+        finding_id: "other",
+        user_id: "other-user",
+        chat_id: "chat-other",
+        title: "Other private finding",
+        target: "private.test",
+        category: "other",
+        status: "active",
+        severity: "critical",
+        cvss_score: 10,
+        search_text: "Other private finding",
+        created_at: 30,
+      },
+    ];
+    const { ctx, indexes } = createMockCtx(tables);
+
+    const first = await listFindings.handler(ctx, {
+      paginationOpts: { cursor: null, numItems: 1 },
+    });
+    expect(first.page.map((item: any) => item.finding_id)).toEqual(["new"]);
+    expect(first.isDone).toBe(false);
+
+    const second = await listFindings.handler(ctx, {
+      paginationOpts: { cursor: first.continueCursor, numItems: 1 },
+    });
+    expect(second.page.map((item: any) => item.finding_id)).toEqual(["old"]);
+
+    const filtered = await listFindings.handler(ctx, {
+      paginationOpts: { cursor: null, numItems: 10 },
+      severity: "critical",
+      chatId: "chat-1",
+    });
+    expect(filtered.page.map((item: any) => item.finding_id)).toEqual(["old"]);
+    expect(indexes).toContain("by_user_severity_chat_created");
+
+    const lifecycleFiltered = await listFindings.handler(ctx, {
+      paginationOpts: { cursor: null, numItems: 10 },
+      status: "closed",
+      category: "access_control",
+      severity: "high",
+      chatId: "chat-2",
+    });
+    expect(lifecycleFiltered.page.map((item: any) => item.finding_id)).toEqual([
+      "new",
+    ]);
+    expect(indexes).toContain("by_user_status_category_severity_chat_created");
+
+    const searched = await listFindings.handler(ctx, {
+      paginationOpts: { cursor: null, numItems: 10 },
+      search: "CWE-639",
+    });
+    expect(searched.page.map((item: any) => item.finding_id)).toEqual(["new"]);
+  });
+
+  it("derives lifecycle metadata when reading a pre-lifecycle finding", async () => {
+    const { listFindings } = await import("../findings");
+    const tables = seedTables();
+    tables.findings = [
+      {
+        _id: "finding-legacy",
+        finding_id: "legacy",
+        user_id: "user-1",
+        chat_id: "chat-1",
+        title: "SQL injection in the login handler",
+        target: "api.example.test",
+        cwe: "CWE-89",
+        severity: "critical",
+        cvss_score: 9.8,
+        search_text: "SQL injection api.example.test CWE-89",
+        created_at: 10,
+      },
+    ];
+    const { ctx } = createMockCtx(tables);
+
+    const result = await listFindings.handler(ctx, {
+      paginationOpts: { cursor: null, numItems: 10 },
+    });
+
+    expect(result.page).toEqual([
+      expect.objectContaining({
+        finding_id: "legacy",
+        category: "injection",
+        status: "active",
+      }),
+    ]);
+  });
+
+  it("lists only source chats that contain the user's findings", async () => {
+    const { getFindingSourceChats } = await import("../findings");
+    const tables = seedTables();
+    tables.finding_sources = [
+      {
+        _id: "finding-source-1",
+        user_id: "user-1",
+        chat_id: "chat-1",
+        chat_title: "Invoice test",
+        finding_count: 1,
+        latest_finding_at: 10,
+      },
+      {
+        _id: "finding-source-2",
+        user_id: "user-1",
+        chat_id: "chat-2",
+        chat_title: "Retest",
+        finding_count: 2,
+        latest_finding_at: 20,
+      },
+      {
+        _id: "finding-source-other",
+        user_id: "other-user",
+        chat_id: "chat-other",
+        chat_title: "Private other chat",
+        finding_count: 1,
+        latest_finding_at: 30,
+      },
+    ];
+    tables.chats.push({
+      _id: "chat-doc-empty",
+      id: "chat-empty",
+      user_id: "user-1",
+      title: "No findings here",
+      update_time: 99,
+    });
+    const { ctx, indexes } = createMockCtx(tables);
+
+    await expect(getFindingSourceChats.handler(ctx, {})).resolves.toEqual([
+      { chat_id: "chat-2", chat_title: "Retest" },
+      { chat_id: "chat-1", chat_title: "Invoice test" },
+    ]);
+    expect(indexes).toContain("by_user_and_latest");
+    expect(indexes).not.toContain("by_user_and_created");
+  });
+
+  it("bounds source-chat metadata reads", async () => {
+    const { getFindingSourceChats } = await import("../findings");
+    const tables = seedTables();
+    tables.finding_sources = Array.from({ length: 501 }, (_, index) => ({
+      _id: `finding-source-${index}`,
+      user_id: "user-1",
+      chat_id: `chat-${index}`,
+      chat_title: `Chat ${index}`,
+      finding_count: 1,
+      latest_finding_at: index,
+    }));
+    const { ctx } = createMockCtx(tables);
+
+    const sources = await getFindingSourceChats.handler(ctx, {});
+
+    expect(sources).toHaveLength(500);
+    expect(sources[0]).toEqual({
+      chat_id: "chat-500",
+      chat_title: "Chat 500",
+    });
+  });
+
+  it("enforces read ownership", async () => {
+    const { getFinding } = await import("../findings");
+    const tables = seedTables();
+    tables.findings = [
+      {
+        _id: "finding-other",
+        finding_id: "other",
+        user_id: "other-user",
+        chat_id: "chat-other",
+        title: "Private",
+      },
+    ];
+    const { ctx } = createMockCtx(tables);
+    await expect(getFinding.handler(ctx, { findingId: "other" })).resolves.toBe(
+      null,
+    );
+  });
+
+  it("closes an owned finding with a reason and context without deleting it", async () => {
+    const { closeFinding } = await import("../findings");
+    const tables = seedTables();
+    tables.findings = [
+      {
+        _id: "finding-doc-1",
+        finding_id: "finding-public-1",
+        user_id: "user-1",
+        status: "active",
+        updated_at: 1,
+      },
+    ];
+    const { ctx, patch, deleteDoc } = createMockCtx(tables);
+
+    await expect(
+      closeFinding.handler(ctx, {
+        findingId: "finding-public-1",
+        reason: "already_fixed",
+        context: "  Confirmed fixed in the July retest.  ",
+      }),
+    ).resolves.toMatchObject({ closed: true, closed_at: expect.any(Number) });
+    expect(patch).toHaveBeenCalledWith(
+      "finding-doc-1",
+      expect.objectContaining({
+        status: "closed",
+        closure_reason: "already_fixed",
+        closure_context: "Confirmed fixed in the July retest.",
+        closed_at: expect.any(Number),
+        updated_at: expect.any(Number),
+      }),
+    );
+    expect(deleteDoc).not.toHaveBeenCalled();
+    expect(tables.messages[0].parts).toHaveLength(3);
+  });
+
+  it("rejects invalid, repeated, and foreign closure requests", async () => {
+    const { closeFinding } = await import("../findings");
+    const tables = seedTables();
+    tables.findings = [
+      {
+        _id: "finding-doc-closed",
+        finding_id: "finding-closed",
+        user_id: "user-1",
+        status: "closed",
+      },
+      {
+        _id: "finding-doc-other",
+        finding_id: "finding-other",
+        user_id: "other-user",
+        status: "active",
+      },
+    ];
+    const { ctx, patch } = createMockCtx(tables);
+
+    await expect(
+      closeFinding.handler(ctx, {
+        findingId: "finding-closed",
+        reason: "wont_fix",
+        context: "Already accepted.",
+      }),
+    ).resolves.toEqual({ closed: false, already_closed: true });
+    await expect(
+      closeFinding.handler(ctx, {
+        findingId: "finding-closed",
+        reason: "wont_fix",
+        context: "   ",
+      }),
+    ).rejects.toMatchObject({
+      data: expect.objectContaining({ code: "INVALID_CLOSURE" }),
+    });
+    await expect(
+      closeFinding.handler(ctx, {
+        findingId: "finding-other",
+        reason: "false_positive",
+        context: "Not reproducible.",
+      }),
+    ).rejects.toMatchObject({
+      data: expect.objectContaining({ code: "ACCESS_DENIED" }),
+    });
+    expect(patch).not.toHaveBeenCalled();
+  });
+
+  it("deletes an owned finding and scrubs its structured source tool part", async () => {
+    const { deleteFinding } = await import("../findings");
+    const tables = seedTables();
+    tables.findings = [
+      {
+        _id: "finding-doc-1",
+        finding_id: "finding-public-1",
+        user_id: "user-1",
+        chat_id: "chat-1",
+        message_id: "message-1",
+        tool_call_id: "tool-1",
+      },
+    ];
+    tables.finding_sources = [
+      {
+        _id: "finding-source-1",
+        user_id: "user-1",
+        chat_id: "chat-1",
+        chat_title: "Invoice test",
+        finding_count: 1,
+        latest_finding_at: 1,
+      },
+    ];
+    const { ctx, patch, deleteDoc } = createMockCtx(tables);
+
+    await expect(
+      deleteFinding.handler(ctx, { findingId: "finding-public-1" }),
+    ).resolves.toEqual({ deleted: true });
+    expect(patch).toHaveBeenCalledWith(
+      "message-doc-1",
+      expect.objectContaining({
+        parts: [
+          { type: "text", text: "Confirmed." },
+          { type: "text", text: "Saved." },
+        ],
+      }),
+    );
+    expect(deleteDoc).toHaveBeenCalledWith("finding-doc-1");
+    expect(deleteDoc).toHaveBeenCalledWith("finding-source-1");
+  });
+
+  it("keeps source metadata while another finding remains in the chat", async () => {
+    const { deleteFinding } = await import("../findings");
+    const tables = seedTables();
+    tables.findings = [
+      {
+        _id: "finding-doc-1",
+        finding_id: "finding-public-1",
+        user_id: "user-1",
+        chat_id: "chat-1",
+        message_id: "message-1",
+        tool_call_id: "tool-1",
+        created_at: 10,
+      },
+      {
+        _id: "finding-doc-2",
+        finding_id: "finding-public-2",
+        user_id: "user-1",
+        chat_id: "chat-1",
+        message_id: "message-2",
+        tool_call_id: "tool-2",
+        created_at: 20,
+      },
+    ];
+    tables.finding_sources = [
+      {
+        _id: "finding-source-1",
+        user_id: "user-1",
+        chat_id: "chat-1",
+        chat_title: "Invoice test",
+        finding_count: 2,
+        latest_finding_at: 20,
+      },
+    ];
+    const { ctx, patch, deleteDoc } = createMockCtx(tables);
+
+    await deleteFinding.handler(ctx, { findingId: "finding-public-2" });
+
+    expect(deleteDoc).toHaveBeenCalledWith("finding-doc-2");
+    expect(deleteDoc).not.toHaveBeenCalledWith("finding-source-1");
+    expect(patch).toHaveBeenCalledWith("finding-source-1", {
+      finding_count: 1,
+      latest_finding_at: 10,
+    });
+  });
+
+  it("rejects deletion by a different user", async () => {
+    const { deleteFinding } = await import("../findings");
+    const tables = seedTables();
+    tables.findings = [
+      {
+        _id: "finding-doc-other",
+        finding_id: "finding-other",
+        user_id: "other-user",
+        chat_id: "chat-other",
+        message_id: "message-other",
+        tool_call_id: "tool-other",
+      },
+    ];
+    const { ctx, deleteDoc } = createMockCtx(tables);
+    await expect(
+      deleteFinding.handler(ctx, { findingId: "finding-other" }),
+    ).rejects.toMatchObject({
+      data: expect.objectContaining({ code: "ACCESS_DENIED" }),
+    });
+    expect(deleteDoc).not.toHaveBeenCalled();
+  });
+});
diff --git a/convex/__tests__/userDeletion.test.ts b/convex/__tests__/userDeletion.test.ts
index 85b8c80ce..1e0e1e525 100644
--- a/convex/__tests__/userDeletion.test.ts
+++ b/convex/__tests__/userDeletion.test.ts
@@ -259,6 +259,40 @@ function seedTables(userId = "user_123", otherUserId = "user_other"): Tables {
       { _id: "note-user", user_id: userId, note_id: "note-1" },
       { _id: "note-other", user_id: otherUserId, note_id: "note-2" },
     ],
+    findings: [
+      {
+        _id: "finding-user",
+        finding_id: "finding-1",
+        user_id: userId,
+        chat_id: "chat-1",
+        created_at: 1,
+      },
+      {
+        _id: "finding-other",
+        finding_id: "finding-2",
+        user_id: otherUserId,
+        chat_id: "chat-other-id",
+        created_at: 1,
+      },
+    ],
+    finding_sources: [
+      {
+        _id: "finding-source-user",
+        user_id: userId,
+        chat_id: "chat-1",
+        chat_title: "User chat",
+        finding_count: 1,
+        latest_finding_at: 1,
+      },
+      {
+        _id: "finding-source-other",
+        user_id: otherUserId,
+        chat_id: "chat-other-id",
+        chat_title: "Other chat",
+        finding_count: 1,
+        latest_finding_at: 1,
+      },
+    ],
     user_customization: [
       { _id: "custom-user", user_id: userId, updated_at: 1 },
       { _id: "custom-other", user_id: otherUserId, updated_at: 1 },
diff --git a/convex/_generated/api.d.ts b/convex/_generated/api.d.ts
index 9626e78ad..443d3b137 100644
--- a/convex/_generated/api.d.ts
+++ b/convex/_generated/api.d.ts
@@ -20,6 +20,7 @@ import type * as feedback from "../feedback.js";
 import type * as fileActions from "../fileActions.js";
 import type * as fileAggregate from "../fileAggregate.js";
 import type * as fileStorage from "../fileStorage.js";
+import type * as findings from "../findings.js";
 import type * as lib_extraUsagePricing from "../lib/extraUsagePricing.js";
 import type * as lib_extraUsageValidation from "../lib/extraUsageValidation.js";
 import type * as lib_logger from "../lib/logger.js";
@@ -66,6 +67,7 @@ declare const fullApi: ApiFromModules<{
   fileActions: typeof fileActions;
   fileAggregate: typeof fileAggregate;
   fileStorage: typeof fileStorage;
+  findings: typeof findings;
   "lib/extraUsagePricing": typeof lib_extraUsagePricing;
   "lib/extraUsageValidation": typeof lib_extraUsageValidation;
   "lib/logger": typeof lib_logger;
diff --git a/convex/chats.ts b/convex/chats.ts
index 1b6d391d7..ea41fcc4a 100644
--- a/convex/chats.ts
+++ b/convex/chats.ts
@@ -28,6 +28,7 @@ import {
 
 const DELETE_ALL_CHATS_MESSAGE_BATCH_SIZE = 10;
 const DELETE_ALL_CHATS_SUMMARY_BATCH_SIZE = 25;
+const DELETE_ALL_CHATS_FINDING_BATCH_SIZE = 25;
 const CHAT_DELETION_FENCE_BATCH_SIZE = 100;
 const MAX_ACTIVE_TRIGGER_RUNS_TO_RETURN = 100;
 const CHAT_SUMMARY_TELEMETRY_CLEANUP_DEFAULT_BATCH_SIZE = 500;
@@ -248,9 +249,67 @@ async function deleteMessageForChatDeletion(
   await ctx.db.delete(message._id);
 }
 
+async function deleteFindingsForChatBatch(
+  ctx: MutationCtx,
+  chat: Doc<"chats">,
+): Promise<boolean> {
+  const findings = await ctx.db
+    .query("findings")
+    .withIndex("by_user_chat_created", (q) =>
+      q.eq("user_id", chat.user_id).eq("chat_id", chat.id),
+    )
+    .take(DELETE_ALL_CHATS_FINDING_BATCH_SIZE + 1);
+
+  for (const finding of findings.slice(
+    0,
+    DELETE_ALL_CHATS_FINDING_BATCH_SIZE,
+  )) {
+    await ctx.db.delete(finding._id);
+  }
+
+  return findings.length > DELETE_ALL_CHATS_FINDING_BATCH_SIZE;
+}
+
+async function deleteFindingSourceForChat(
+  ctx: MutationCtx,
+  chat: Doc<"chats">,
+) {
+  const source = await ctx.db
+    .query("finding_sources")
+    .withIndex("by_user_chat", (q) =>
+      q.eq("user_id", chat.user_id).eq("chat_id", chat.id),
+    )
+    .unique();
+  if (source) await ctx.db.delete(source._id);
+}
+
+async function syncFindingSourceChatTitle(
+  ctx: MutationCtx,
+  userId: string,
+  chatId: string,
+  title: string,
+) {
+  const source = await ctx.db
+    .query("finding_sources")
+    .withIndex("by_user_chat", (q) =>
+      q.eq("user_id", userId).eq("chat_id", chatId),
+    )
+    .unique();
+  if (source && source.chat_title !== title) {
+    await ctx.db.patch(source._id, { chat_title: title });
+  }
+}
+
 async function deleteChatDocument(ctx: MutationCtx, chat: Doc<"chats">) {
   await prepareChatForDeletion(ctx, chat);
 
+  if (await deleteFindingsForChatBatch(ctx, chat)) {
+    await scheduleDeleteChatDocumentBatch(ctx, chat.id, chat.user_id);
+    return;
+  }
+
+  await deleteFindingSourceForChat(ctx, chat);
+
   const messages = await ctx.db
     .query("messages")
     .withIndex("by_chat_id", (q) => q.eq("chat_id", chat.id))
@@ -321,6 +380,13 @@ async function deleteNextUserChatBatch(ctx: MutationCtx, userId: string) {
 
   await prepareChatForDeletion(ctx, chat);
 
+  if (await deleteFindingsForChatBatch(ctx, chat)) {
+    await scheduleDeleteAllChatsBatch(ctx, userId);
+    return true;
+  }
+
+  await deleteFindingSourceForChat(ctx, chat);
+
   const messages = await ctx.db
     .query("messages")
     .withIndex("by_chat_id", (q) => q.eq("chat_id", chat.id))
@@ -806,6 +872,12 @@ export const updateChat = mutation({
 
       if (args.title !== undefined) {
         updateData.title = args.title;
+        await syncFindingSourceChatTitle(
+          ctx,
+          chat.user_id,
+          chat.id,
+          args.title,
+        );
       }
 
       if (args.finishReason !== undefined) {
@@ -1328,6 +1400,12 @@ export const renameChat = mutation({
         title: trimmedTitle,
         update_time: Date.now(),
       });
+      await syncFindingSourceChatTitle(
+        ctx,
+        chat.user_id,
+        chat.id,
+        trimmedTitle,
+      );
 
       return null;
     } catch (error) {
@@ -1694,78 +1772,7 @@ export const deleteAllChatsForUser = mutation({
   returns: v.null(),
   handler: async (ctx, args) => {
     validateServiceKey(args.serviceKey);
-
-    const userChats = await ctx.db
-      .query("chats")
-      .withIndex("by_user_and_updated", (q) => q.eq("user_id", args.userId))
-      .collect();
-
-    for (const chat of userChats) {
-      const messages = await ctx.db
-        .query("messages")
-        .withIndex("by_chat_id", (q) => q.eq("chat_id", chat.id))
-        .collect();
-
-      for (const message of messages) {
-        if (!message.source_message_id && message.file_ids?.length) {
-          for (const fileId of message.file_ids) {
-            try {
-              const file = await ctx.db.get(fileId);
-              if (file) {
-                if (file.s3_key) {
-                  await ctx.scheduler.runAfter(
-                    0,
-                    internal.s3Cleanup.deleteS3ObjectAction,
-                    { s3Key: file.s3_key },
-                  );
-                }
-                await fileCountAggregate.deleteIfExists(ctx, file);
-                await ctx.db.delete(file._id);
-              }
-            } catch (error) {
-              console.error(`Failed to delete file ${fileId}:`, error);
-            }
-          }
-        }
-        if (message.feedback_id) {
-          try {
-            await ctx.db.delete(message.feedback_id);
-          } catch (error) {
-            console.error(
-              `Failed to delete feedback ${message.feedback_id}:`,
-              error,
-            );
-          }
-        }
-        await ctx.db.delete(message._id);
-      }
-
-      if (chat.latest_summary_id) {
-        try {
-          await ctx.db.delete(chat.latest_summary_id);
-        } catch (error) {
-          console.error(
-            `Failed to delete summary ${chat.latest_summary_id}:`,
-            error,
-          );
-        }
-      }
-
-      const summaries = await ctx.db
-        .query("chat_summaries")
-        .withIndex("by_chat_id", (q) => q.eq("chat_id", chat.id))
-        .collect();
-      for (const summary of summaries) {
-        try {
-          await ctx.db.delete(summary._id);
-        } catch (error) {
-          console.error(`Failed to delete summary ${summary._id}:`, error);
-        }
-      }
-
-      await ctx.db.delete(chat._id);
-    }
-
+    await deleteNextUserChatBatch(ctx, args.userId);
     return null;
   },
 });
diff --git a/convex/findings.ts b/convex/findings.ts
new file mode 100644
index 000000000..a44041ebb
--- /dev/null
+++ b/convex/findings.ts
@@ -0,0 +1,624 @@
+import { mutation, query } from "./_generated/server";
+import type { QueryCtx } from "./_generated/server";
+import { paginationOptsValidator } from "convex/server";
+import { ConvexError, v } from "convex/values";
+import { validateServiceKey } from "./lib/utils";
+import { assertUserCanAccessChatHistory } from "./lib/suspensionGuards";
+import { calculateCvss31 } from "../lib/findings/cvss31";
+import {
+  createFindingDedupeKey,
+  createFindingSearchText,
+  createVulnerabilityReportInputSchema,
+} from "../lib/findings/validation";
+import {
+  deriveFindingCategory,
+  FINDING_CATEGORIES,
+  FINDING_CATEGORY_LABELS,
+  type FindingCategory,
+} from "../lib/findings/category";
+import {
+  closeFindingInputSchema,
+  type FindingStatus,
+} from "../lib/findings/lifecycle";
+import type { Doc } from "./_generated/dataModel";
+
+const MAX_SEARCH_LENGTH = 200;
+const MAX_FINDING_SOURCE_CHATS = 500;
+
+const findingSeverityArgValidator = v.union(
+  v.literal("critical"),
+  v.literal("high"),
+  v.literal("medium"),
+  v.literal("low"),
+  v.literal("info"),
+);
+
+const findingCategoryArgValidator = v.union(
+  v.literal("access_control"),
+  v.literal("authentication_session"),
+  v.literal("injection"),
+  v.literal("cross_site_scripting"),
+  v.literal("request_forgery"),
+  v.literal("file_path_access"),
+  v.literal("data_exposure"),
+  v.literal("cryptography_secrets"),
+  v.literal("parsing_deserialization"),
+  v.literal("security_misconfiguration"),
+  v.literal("denial_of_service"),
+  v.literal("business_logic"),
+  v.literal("other"),
+);
+
+const findingStatusArgValidator = v.union(
+  v.literal("active"),
+  v.literal("closed"),
+);
+
+const findingClosureReasonArgValidator = v.union(
+  v.literal("already_fixed"),
+  v.literal("wont_fix"),
+  v.literal("false_positive"),
+);
+
+type FindingReadCtx = Pick<QueryCtx, "db">;
+
+const getChat = async (ctx: FindingReadCtx, chatId: string) =>
+  await ctx.db
+    .query("chats")
+    .withIndex("by_chat_id", (q) => q.eq("id", chatId))
+    .unique();
+
+const getFindingByPublicId = async (ctx: FindingReadCtx, findingId: string) =>
+  await ctx.db
+    .query("findings")
+    .withIndex("by_finding_id", (q) => q.eq("finding_id", findingId))
+    .unique();
+
+const getFindingSource = async (
+  ctx: FindingReadCtx,
+  userId: string,
+  chatId: string,
+) =>
+  await ctx.db
+    .query("finding_sources")
+    .withIndex("by_user_chat", (q) =>
+      q.eq("user_id", userId).eq("chat_id", chatId),
+    )
+    .unique();
+
+type FindingListFilters = {
+  severity?: Doc<"findings">["severity"];
+  category?: FindingCategory;
+  status?: FindingStatus;
+  chatId?: string;
+};
+
+const getFindingsByFacets = (
+  ctx: FindingReadCtx,
+  userId: string,
+  { severity, category, status, chatId }: FindingListFilters,
+) => {
+  if (status && category && severity && chatId) {
+    return ctx.db
+      .query("findings")
+      .withIndex("by_user_status_category_severity_chat_created", (q) =>
+        q
+          .eq("user_id", userId)
+          .eq("status", status)
+          .eq("category", category)
+          .eq("severity", severity)
+          .eq("chat_id", chatId),
+      );
+  }
+  if (status && category && severity) {
+    return ctx.db
+      .query("findings")
+      .withIndex("by_user_status_category_severity_created", (q) =>
+        q
+          .eq("user_id", userId)
+          .eq("status", status)
+          .eq("category", category)
+          .eq("severity", severity),
+      );
+  }
+  if (status && category && chatId) {
+    return ctx.db
+      .query("findings")
+      .withIndex("by_user_status_category_chat_created", (q) =>
+        q
+          .eq("user_id", userId)
+          .eq("status", status)
+          .eq("category", category)
+          .eq("chat_id", chatId),
+      );
+  }
+  if (status && severity && chatId) {
+    return ctx.db
+      .query("findings")
+      .withIndex("by_user_status_severity_chat_created", (q) =>
+        q
+          .eq("user_id", userId)
+          .eq("status", status)
+          .eq("severity", severity)
+          .eq("chat_id", chatId),
+      );
+  }
+  if (category && severity && chatId) {
+    return ctx.db
+      .query("findings")
+      .withIndex("by_user_category_severity_chat_created", (q) =>
+        q
+          .eq("user_id", userId)
+          .eq("category", category)
+          .eq("severity", severity)
+          .eq("chat_id", chatId),
+      );
+  }
+  if (status && category) {
+    return ctx.db
+      .query("findings")
+      .withIndex("by_user_status_category_created", (q) =>
+        q.eq("user_id", userId).eq("status", status).eq("category", category),
+      );
+  }
+  if (status && severity) {
+    return ctx.db
+      .query("findings")
+      .withIndex("by_user_status_severity_created", (q) =>
+        q.eq("user_id", userId).eq("status", status).eq("severity", severity),
+      );
+  }
+  if (status && chatId) {
+    return ctx.db
+      .query("findings")
+      .withIndex("by_user_status_chat_created", (q) =>
+        q.eq("user_id", userId).eq("status", status).eq("chat_id", chatId),
+      );
+  }
+  if (category && severity) {
+    return ctx.db
+      .query("findings")
+      .withIndex("by_user_category_severity_created", (q) =>
+        q
+          .eq("user_id", userId)
+          .eq("category", category)
+          .eq("severity", severity),
+      );
+  }
+  if (category && chatId) {
+    return ctx.db
+      .query("findings")
+      .withIndex("by_user_category_chat_created", (q) =>
+        q.eq("user_id", userId).eq("category", category).eq("chat_id", chatId),
+      );
+  }
+  if (severity && chatId) {
+    return ctx.db
+      .query("findings")
+      .withIndex("by_user_severity_chat_created", (q) =>
+        q.eq("user_id", userId).eq("severity", severity).eq("chat_id", chatId),
+      );
+  }
+  if (status) {
+    return ctx.db
+      .query("findings")
+      .withIndex("by_user_status_created", (q) =>
+        q.eq("user_id", userId).eq("status", status),
+      );
+  }
+  if (category) {
+    return ctx.db
+      .query("findings")
+      .withIndex("by_user_category_created", (q) =>
+        q.eq("user_id", userId).eq("category", category),
+      );
+  }
+  if (severity) {
+    return ctx.db
+      .query("findings")
+      .withIndex("by_user_severity_created", (q) =>
+        q.eq("user_id", userId).eq("severity", severity),
+      );
+  }
+  if (chatId) {
+    return ctx.db
+      .query("findings")
+      .withIndex("by_user_chat_created", (q) =>
+        q.eq("user_id", userId).eq("chat_id", chatId),
+      );
+  }
+  return ctx.db
+    .query("findings")
+    .withIndex("by_user_and_created", (q) => q.eq("user_id", userId));
+};
+
+const toFindingSummary = (finding: Doc<"findings">, chatTitle: string) => {
+  const category =
+    finding.category ??
+    deriveFindingCategory({ cwe: finding.cwe, title: finding.title });
+
+  return {
+    finding_id: finding.finding_id,
+    title: finding.title,
+    target: finding.target,
+    ...(finding.endpoint ? { endpoint: finding.endpoint } : {}),
+    severity: finding.severity,
+    cvss_score: finding.cvss_score,
+    category,
+    status: finding.status ?? ("active" as const),
+    chat_id: finding.chat_id,
+    chat_title: chatTitle,
+    created_at: finding.created_at,
+  };
+};
+
+const toFindingDetail = (finding: Doc<"findings">, chatTitle: string) => ({
+  ...toFindingSummary(finding, chatTitle),
+  description: finding.description,
+  impact: finding.impact,
+  technical_analysis: finding.technical_analysis,
+  poc_description: finding.poc_description,
+  poc_script_code: finding.poc_script_code,
+  remediation_steps: finding.remediation_steps,
+  evidence: finding.evidence,
+  assumptions: finding.assumptions,
+  fix_effort: finding.fix_effort,
+  cvss_breakdown: finding.cvss_breakdown,
+  cvss_vector: finding.cvss_vector,
+  ...(finding.method ? { method: finding.method } : {}),
+  ...(finding.cve ? { cve: finding.cve } : {}),
+  ...(finding.cwe ? { cwe: finding.cwe } : {}),
+  ...(finding.code_locations ? { code_locations: finding.code_locations } : {}),
+  message_id: finding.message_id,
+  ...(finding.closure_reason ? { closure_reason: finding.closure_reason } : {}),
+  ...(finding.closure_context
+    ? { closure_context: finding.closure_context }
+    : {}),
+  ...(finding.closed_at ? { closed_at: finding.closed_at } : {}),
+  updated_at: finding.updated_at,
+});
+
+export const createFindingForBackend = mutation({
+  args: {
+    serviceKey: v.string(),
+    userId: v.string(),
+    chatId: v.string(),
+    messageId: v.string(),
+    toolCallId: v.string(),
+    report: v.any(),
+  },
+  handler: async (ctx, args) => {
+    validateServiceKey(args.serviceKey);
+
+    const parsed = createVulnerabilityReportInputSchema.safeParse(args.report);
+    if (!parsed.success) {
+      return {
+        success: false as const,
+        error: "validation" as const,
+        message: "The vulnerability report did not pass validation.",
+      };
+    }
+
+    const chat = await getChat(ctx, args.chatId);
+    if (
+      !chat ||
+      chat.user_id !== args.userId ||
+      chat.deletion_started_at ||
+      chat.canceled_at
+    ) {
+      return {
+        success: false as const,
+        error: "chat_not_found" as const,
+        message: "The source chat is no longer available.",
+      };
+    }
+
+    const input = parsed.data;
+    const dedupeKey = createFindingDedupeKey(input);
+    const duplicate = await ctx.db
+      .query("findings")
+      .withIndex("by_user_chat_dedupe", (q) =>
+        q
+          .eq("user_id", args.userId)
+          .eq("chat_id", args.chatId)
+          .eq("dedupe_key", dedupeKey),
+      )
+      .first();
+
+    if (duplicate) {
+      return {
+        success: false as const,
+        error: "duplicate" as const,
+        message: "A matching finding already exists in this chat.",
+      };
+    }
+
+    const findingId = crypto.randomUUID();
+    const now = Date.now();
+    const cvss = calculateCvss31(input.cvss_breakdown);
+    const method = input.method?.toUpperCase();
+    const category = deriveFindingCategory({
+      cwe: input.cwe,
+      title: input.title,
+    });
+
+    await ctx.db.insert("findings", {
+      finding_id: findingId,
+      user_id: args.userId,
+      chat_id: args.chatId,
+      message_id: args.messageId,
+      tool_call_id: args.toolCallId,
+      title: input.title,
+      description: input.description,
+      impact: input.impact,
+      target: input.target,
+      technical_analysis: input.technical_analysis,
+      poc_description: input.poc_description,
+      poc_script_code: input.poc_script_code,
+      remediation_steps: input.remediation_steps,
+      evidence: input.evidence,
+      assumptions: input.assumptions,
+      fix_effort: input.fix_effort,
+      cvss_breakdown: input.cvss_breakdown,
+      cvss_score: cvss.score,
+      cvss_vector: cvss.vector,
+      severity: cvss.severity,
+      category,
+      status: "active",
+      ...(input.endpoint ? { endpoint: input.endpoint } : {}),
+      ...(method ? { method } : {}),
+      ...(input.cve ? { cve: input.cve } : {}),
+      ...(input.cwe ? { cwe: input.cwe } : {}),
+      ...(input.code_locations ? { code_locations: input.code_locations } : {}),
+      dedupe_key: dedupeKey,
+      search_text: createFindingSearchText(
+        input,
+        FINDING_CATEGORY_LABELS[category],
+      ),
+      created_at: now,
+      updated_at: now,
+    });
+
+    const source = await getFindingSource(ctx, args.userId, args.chatId);
+    if (source) {
+      await ctx.db.patch(source._id, {
+        chat_title: chat.title,
+        finding_count: source.finding_count + 1,
+        latest_finding_at: now,
+      });
+    } else {
+      await ctx.db.insert("finding_sources", {
+        user_id: args.userId,
+        chat_id: args.chatId,
+        chat_title: chat.title,
+        finding_count: 1,
+        latest_finding_at: now,
+      });
+    }
+
+    return {
+      success: true as const,
+      finding_id: findingId,
+      title: input.title,
+      target: input.target,
+      ...(input.endpoint ? { endpoint: input.endpoint } : {}),
+      severity: cvss.severity,
+      cvss_score: cvss.score,
+    };
+  },
+});
+
+export const getFinding = query({
+  args: { findingId: v.string() },
+  handler: async (ctx, args) => {
+    const identity = await ctx.auth.getUserIdentity();
+    if (!identity) return null;
+    await assertUserCanAccessChatHistory(ctx, identity.subject);
+
+    const finding = await getFindingByPublicId(ctx, args.findingId);
+    if (!finding || finding.user_id !== identity.subject) return null;
+
+    const chat = await getChat(ctx, finding.chat_id);
+    return toFindingDetail(finding, chat?.title ?? "Deleted chat");
+  },
+});
+
+export const listFindings = query({
+  args: {
+    paginationOpts: paginationOptsValidator,
+    search: v.optional(v.string()),
+    severity: v.optional(findingSeverityArgValidator),
+    category: v.optional(findingCategoryArgValidator),
+    status: v.optional(findingStatusArgValidator),
+    chatId: v.optional(v.string()),
+  },
+  handler: async (ctx, args) => {
+    const identity = await ctx.auth.getUserIdentity();
+    if (!identity) {
+      return { page: [], isDone: true, continueCursor: "" };
+    }
+    await assertUserCanAccessChatHistory(ctx, identity.subject);
+
+    const search = args.search?.trim().slice(0, MAX_SEARCH_LENGTH);
+    let page: Doc<"findings">[];
+    let isDone: boolean;
+    let continueCursor: string;
+
+    if (search) {
+      const result = await ctx.db
+        .query("findings")
+        .withSearchIndex("search_findings", (q) => {
+          let builder = q
+            .search("search_text", search)
+            .eq("user_id", identity.subject);
+          if (args.status) builder = builder.eq("status", args.status);
+          if (args.category) builder = builder.eq("category", args.category);
+          if (args.severity) builder = builder.eq("severity", args.severity);
+          if (args.chatId) builder = builder.eq("chat_id", args.chatId);
+          return builder;
+        })
+        .paginate(args.paginationOpts);
+
+      page = result.page;
+      isDone = result.isDone;
+      continueCursor = result.continueCursor;
+    } else {
+      const findingsQuery = getFindingsByFacets(ctx, identity.subject, args);
+
+      const result = await findingsQuery
+        .order("desc")
+        .paginate(args.paginationOpts);
+      page = result.page;
+      isDone = result.isDone;
+      continueCursor = result.continueCursor;
+    }
+
+    const summaries = await Promise.all(
+      page.map(async (finding) => {
+        const chat = await getChat(ctx, finding.chat_id);
+        return toFindingSummary(finding, chat?.title ?? "Deleted chat");
+      }),
+    );
+
+    return { page: summaries, isDone, continueCursor };
+  },
+});
+
+export const getFindingSourceChats = query({
+  args: {},
+  handler: async (ctx) => {
+    const identity = await ctx.auth.getUserIdentity();
+    if (!identity) return [];
+    await assertUserCanAccessChatHistory(ctx, identity.subject);
+
+    const sources = await ctx.db
+      .query("finding_sources")
+      .withIndex("by_user_and_latest", (q) => q.eq("user_id", identity.subject))
+      .order("desc")
+      .take(MAX_FINDING_SOURCE_CHATS);
+
+    return sources.map((source) => ({
+      chat_id: source.chat_id,
+      chat_title: source.chat_title,
+    }));
+  },
+});
+
+export const closeFinding = mutation({
+  args: {
+    findingId: v.string(),
+    reason: findingClosureReasonArgValidator,
+    context: v.string(),
+  },
+  handler: async (ctx, args) => {
+    const identity = await ctx.auth.getUserIdentity();
+    if (!identity) {
+      throw new ConvexError({ code: "UNAUTHORIZED", message: "Unauthorized" });
+    }
+    await assertUserCanAccessChatHistory(ctx, identity.subject);
+
+    const parsed = closeFindingInputSchema.safeParse({
+      reason: args.reason,
+      context: args.context,
+    });
+    if (!parsed.success) {
+      throw new ConvexError({
+        code: "INVALID_CLOSURE",
+        message: parsed.error.issues[0]?.message ?? "Invalid closure details",
+      });
+    }
+
+    const finding = await getFindingByPublicId(ctx, args.findingId);
+    if (!finding) return { closed: false, not_found: true };
+    if (finding.user_id !== identity.subject) {
+      throw new ConvexError({
+        code: "ACCESS_DENIED",
+        message: "Access denied",
+      });
+    }
+    if (finding.status === "closed") {
+      return { closed: false, already_closed: true };
+    }
+
+    const now = Date.now();
+    await ctx.db.patch(finding._id, {
+      status: "closed",
+      category:
+        finding.category ??
+        deriveFindingCategory({ cwe: finding.cwe, title: finding.title }),
+      closure_reason: parsed.data.reason,
+      closure_context: parsed.data.context,
+      closed_at: now,
+      updated_at: now,
+    });
+
+    return { closed: true, closed_at: now };
+  },
+});
+
+export const deleteFinding = mutation({
+  args: { findingId: v.string() },
+  handler: async (ctx, args) => {
+    const identity = await ctx.auth.getUserIdentity();
+    if (!identity) {
+      throw new ConvexError({ code: "UNAUTHORIZED", message: "Unauthorized" });
+    }
+    await assertUserCanAccessChatHistory(ctx, identity.subject);
+
+    const finding = await getFindingByPublicId(ctx, args.findingId);
+    if (!finding) return { deleted: false };
+    if (finding.user_id !== identity.subject) {
+      throw new ConvexError({
+        code: "ACCESS_DENIED",
+        message: "Access denied",
+      });
+    }
+
+    const message = await ctx.db
+      .query("messages")
+      .withIndex("by_message_id", (q) => q.eq("id", finding.message_id))
+      .first();
+    if (
+      message &&
+      message.user_id === identity.subject &&
+      message.chat_id === finding.chat_id
+    ) {
+      const scrubbedParts = message.parts.filter(
+        (part: any) => part?.toolCallId !== finding.tool_call_id,
+      );
+      if (scrubbedParts.length !== message.parts.length) {
+        await ctx.db.patch(message._id, {
+          parts: scrubbedParts,
+          update_time: Date.now(),
+        });
+      }
+    }
+
+    await ctx.db.delete(finding._id);
+
+    const source = await getFindingSource(
+      ctx,
+      identity.subject,
+      finding.chat_id,
+    );
+    if (source) {
+      const latestRemaining = await ctx.db
+        .query("findings")
+        .withIndex("by_user_chat_created", (q) =>
+          q.eq("user_id", identity.subject).eq("chat_id", finding.chat_id),
+        )
+        .order("desc")
+        .first();
+
+      if (latestRemaining) {
+        await ctx.db.patch(source._id, {
+          finding_count: Math.max(1, source.finding_count - 1),
+          latest_finding_at: latestRemaining.created_at,
+        });
+      } else {
+        await ctx.db.delete(source._id);
+      }
+    }
+    return { deleted: true };
+  },
+});
diff --git a/convex/messages.ts b/convex/messages.ts
index c3e50cc8b..c3afe2152 100644
--- a/convex/messages.ts
+++ b/convex/messages.ts
@@ -16,6 +16,7 @@ import {
   isUserBlockedByActiveFraudDispute,
 } from "./lib/suspensionGuards";
 import { stripOpenRouterReasoningMetadataFromParts } from "../lib/chat/provider-metadata-sanitizer";
+import { sanitizeFindingPartsForShare } from "../lib/findings/share-sanitizer";
 import {
   MAX_MESSAGE_SEARCH_QUERY_LENGTH,
   MIN_MESSAGE_SEARCH_QUERY_LENGTH,
@@ -2116,22 +2117,22 @@ export const getSharedMessages = query({
         content: msg.content,
         update_time: msg.update_time,
         // Process parts to replace files/images with placeholders
-        parts: stripOpenRouterReasoningMetadataFromParts(msg.parts).map(
-          (part: any) => {
-            // Replace file references with placeholder
-            if (part.type === "file") {
-              // Determine if it's an image based on mediaType
-              const isImage = part.mediaType?.startsWith("image/");
-              return {
-                type: isImage ? "image" : "file",
-                placeholder: true,
-                // SECURITY: Do NOT include url, file_id, name, or mediaType
-              };
-            }
-            // Keep text parts as-is
-            return part;
-          },
-        ),
+        parts: sanitizeFindingPartsForShare(
+          stripOpenRouterReasoningMetadataFromParts(msg.parts),
+        ).map((part: any) => {
+          // Replace file references with placeholder
+          if (part.type === "file") {
+            // Determine if it's an image based on mediaType
+            const isImage = part.mediaType?.startsWith("image/");
+            return {
+              type: isImage ? "image" : "file",
+              placeholder: true,
+              // SECURITY: Do NOT include url, file_id, name, or mediaType
+            };
+          }
+          // Keep text parts as-is
+          return part;
+        }),
         // SECURITY: user_id is NOT included in response (anonymity)
       }));
     } catch (error) {
diff --git a/convex/schema.ts b/convex/schema.ts
index 47a7045e8..f4828892a 100644
--- a/convex/schema.ts
+++ b/convex/schema.ts
@@ -49,6 +49,57 @@ const agentApprovalTargetGrantValidator = v.union(
   }),
 );
 
+const findingSeverityValidator = v.union(
+  v.literal("critical"),
+  v.literal("high"),
+  v.literal("medium"),
+  v.literal("low"),
+  v.literal("info"),
+);
+
+const findingCategoryValidator = v.union(
+  v.literal("access_control"),
+  v.literal("authentication_session"),
+  v.literal("injection"),
+  v.literal("cross_site_scripting"),
+  v.literal("request_forgery"),
+  v.literal("file_path_access"),
+  v.literal("data_exposure"),
+  v.literal("cryptography_secrets"),
+  v.literal("parsing_deserialization"),
+  v.literal("security_misconfiguration"),
+  v.literal("denial_of_service"),
+  v.literal("business_logic"),
+  v.literal("other"),
+);
+
+const findingStatusValidator = v.union(
+  v.literal("active"),
+  v.literal("closed"),
+);
+
+const findingClosureReasonValidator = v.union(
+  v.literal("already_fixed"),
+  v.literal("wont_fix"),
+  v.literal("false_positive"),
+);
+
+const cvss31BreakdownValidator = v.object({
+  attack_vector: v.union(
+    v.literal("N"),
+    v.literal("A"),
+    v.literal("L"),
+    v.literal("P"),
+  ),
+  attack_complexity: v.union(v.literal("L"), v.literal("H")),
+  privileges_required: v.union(v.literal("N"), v.literal("L"), v.literal("H")),
+  user_interaction: v.union(v.literal("N"), v.literal("R")),
+  scope: v.union(v.literal("U"), v.literal("C")),
+  confidentiality: v.union(v.literal("N"), v.literal("L"), v.literal("H")),
+  integrity: v.union(v.literal("N"), v.literal("L"), v.literal("H")),
+  availability: v.union(v.literal("N"), v.literal("L"), v.literal("H")),
+});
+
 export default defineSchema({
   projects: defineTable({
     user_id: v.string(),
@@ -193,6 +244,157 @@ export default defineSchema({
       filterFields: ["user_id"],
     }),
 
+  findings: defineTable({
+    finding_id: v.string(),
+    user_id: v.string(),
+    chat_id: v.string(),
+    message_id: v.string(),
+    tool_call_id: v.string(),
+    title: v.string(),
+    description: v.string(),
+    impact: v.string(),
+    target: v.string(),
+    technical_analysis: v.string(),
+    poc_description: v.string(),
+    poc_script_code: v.string(),
+    remediation_steps: v.string(),
+    evidence: v.string(),
+    assumptions: v.string(),
+    fix_effort: v.union(
+      v.literal("trivial"),
+      v.literal("low"),
+      v.literal("medium"),
+      v.literal("high"),
+    ),
+    cvss_breakdown: cvss31BreakdownValidator,
+    cvss_score: v.number(),
+    cvss_vector: v.string(),
+    severity: findingSeverityValidator,
+    // Optional only for findings created before lifecycle/category support.
+    // Every new finding persists both fields, and reads derive safe defaults.
+    category: v.optional(findingCategoryValidator),
+    status: v.optional(findingStatusValidator),
+    endpoint: v.optional(v.string()),
+    method: v.optional(v.string()),
+    cve: v.optional(v.string()),
+    cwe: v.optional(v.string()),
+    code_locations: v.optional(
+      v.array(
+        v.object({
+          file: v.string(),
+          start_line: v.number(),
+          end_line: v.number(),
+          snippet: v.optional(v.string()),
+          label: v.optional(v.string()),
+          fix_before: v.optional(v.string()),
+          fix_after: v.optional(v.string()),
+        }),
+      ),
+    ),
+    dedupe_key: v.string(),
+    search_text: v.string(),
+    closure_reason: v.optional(findingClosureReasonValidator),
+    closure_context: v.optional(v.string()),
+    closed_at: v.optional(v.number()),
+    created_at: v.number(),
+    updated_at: v.number(),
+  })
+    .index("by_finding_id", ["finding_id"])
+    .index("by_user_and_created", ["user_id", "created_at"])
+    .index("by_user_severity_created", ["user_id", "severity", "created_at"])
+    .index("by_user_category_created", ["user_id", "category", "created_at"])
+    .index("by_user_category_severity_created", [
+      "user_id",
+      "category",
+      "severity",
+      "created_at",
+    ])
+    .index("by_user_status_created", ["user_id", "status", "created_at"])
+    .index("by_user_status_severity_created", [
+      "user_id",
+      "status",
+      "severity",
+      "created_at",
+    ])
+    .index("by_user_status_category_created", [
+      "user_id",
+      "status",
+      "category",
+      "created_at",
+    ])
+    .index("by_user_status_category_severity_created", [
+      "user_id",
+      "status",
+      "category",
+      "severity",
+      "created_at",
+    ])
+    .index("by_user_severity_chat_created", [
+      "user_id",
+      "severity",
+      "chat_id",
+      "created_at",
+    ])
+    .index("by_user_chat_created", ["user_id", "chat_id", "created_at"])
+    .index("by_user_category_chat_created", [
+      "user_id",
+      "category",
+      "chat_id",
+      "created_at",
+    ])
+    .index("by_user_category_severity_chat_created", [
+      "user_id",
+      "category",
+      "severity",
+      "chat_id",
+      "created_at",
+    ])
+    .index("by_user_status_chat_created", [
+      "user_id",
+      "status",
+      "chat_id",
+      "created_at",
+    ])
+    .index("by_user_status_severity_chat_created", [
+      "user_id",
+      "status",
+      "severity",
+      "chat_id",
+      "created_at",
+    ])
+    .index("by_user_status_category_chat_created", [
+      "user_id",
+      "status",
+      "category",
+      "chat_id",
+      "created_at",
+    ])
+    .index("by_user_status_category_severity_chat_created", [
+      "user_id",
+      "status",
+      "category",
+      "severity",
+      "chat_id",
+      "created_at",
+    ])
+    .index("by_user_chat_dedupe", ["user_id", "chat_id", "dedupe_key"])
+    .searchIndex("search_findings", {
+      searchField: "search_text",
+      filterFields: ["user_id", "status", "category", "severity", "chat_id"],
+    }),
+
+  // Compact source-chat metadata keeps the Findings filter bounded without
+  // reading large PoC/evidence payloads from every finding.
+  finding_sources: defineTable({
+    user_id: v.string(),
+    chat_id: v.string(),
+    chat_title: v.string(),
+    finding_count: v.number(),
+    latest_finding_at: v.number(),
+  })
+    .index("by_user_and_latest", ["user_id", "latest_finding_at"])
+    .index("by_user_chat", ["user_id", "chat_id"]),
+
   files: defineTable({
     s3_key: v.optional(v.string()),
     user_id: v.string(),
diff --git a/convex/sharedChats.ts b/convex/sharedChats.ts
index 6c3dc0452..dc6bbf368 100644
--- a/convex/sharedChats.ts
+++ b/convex/sharedChats.ts
@@ -6,6 +6,7 @@ import {
   isUserBlockedByActiveFraudDispute,
 } from "./lib/suspensionGuards";
 import { stripOpenRouterReasoningMetadataFromParts } from "../lib/chat/provider-metadata-sanitizer";
+import { sanitizeFindingPartsForShare } from "../lib/findings/share-sanitizer";
 
 /**
  * Share a chat by creating a public share link.
@@ -366,8 +367,8 @@ export const forkSharedChat = mutation({
       // Remove file/image parts entirely — the forking user doesn't own the
       // original files, signed URLs will expire, and placeholder parts render
       // as broken "Unknown file" cards in the regular chat view.
-      const sanitizedParts = stripOpenRouterReasoningMetadataFromParts(
-        msg.parts,
+      const sanitizedParts = sanitizeFindingPartsForShare(
+        stripOpenRouterReasoningMetadataFromParts(msg.parts),
       ).filter((part: any) => part.type !== "file");
       await ctx.db.insert("messages", {
         id: newMessageId,
diff --git a/convex/userDeletion.ts b/convex/userDeletion.ts
index 97eb4c11c..7b6bffcd6 100644
--- a/convex/userDeletion.ts
+++ b/convex/userDeletion.ts
@@ -15,6 +15,8 @@ export const USER_DELETION_TABLE_POLICY = {
     "messages",
     "files",
     "feedback",
+    "findings",
+    "finding_sources",
     "notes",
     "user_customization",
     "extra_usage",
@@ -370,6 +372,20 @@ async function cleanupUserDataForUser(
     "by_user_and_updated",
     (q) => q.eq("user_id", userId),
   );
+  const findingsBatch = await collectByIndexBatch<Doc<"findings">>(
+    ctx,
+    budget,
+    "findings",
+    "by_user_and_created",
+    (q) => q.eq("user_id", userId),
+  );
+  const findingSourcesBatch = await collectByIndexBatch<Doc<"finding_sources">>(
+    ctx,
+    budget,
+    "finding_sources",
+    "by_user_and_latest",
+    (q) => q.eq("user_id", userId),
+  );
   const customizationBatch = await collectByIndexBatch<
     Doc<"user_customization">
   >(ctx, budget, "user_customization", "by_user_id", (q) =>
@@ -418,6 +434,8 @@ async function cleanupUserDataForUser(
     projectsBatch,
     chatsBatch,
     filesBatch,
+    findingsBatch,
+    findingSourcesBatch,
     notesBatch,
     customizationBatch,
     messagesBatch,
@@ -432,6 +450,8 @@ async function cleanupUserDataForUser(
 
   const projects = projectsBatch.docs;
   const files = filesBatch.docs;
+  const findings = findingsBatch.docs;
+  const findingSources = findingSourcesBatch.docs;
   const notes = notesBatch.docs;
   const customization = customizationBatch.docs;
   const tempStreams = tempStreamsBatch.docs;
@@ -454,6 +474,8 @@ async function cleanupUserDataForUser(
   await deleteDocs(ctx, stats, "chats", chatsReadyToDelete, mode);
   await deleteDocs(ctx, stats, "projects", projects, mode);
   await deleteFiles(ctx, stats, files, mode);
+  await deleteDocs(ctx, stats, "findings", findings, mode);
+  await deleteDocs(ctx, stats, "finding_sources", findingSources, mode);
   await deleteDocs(ctx, stats, "notes", notes, mode);
   await deleteDocs(ctx, stats, "user_customization", customization, mode);
   await deleteDocs(ctx, stats, "temp_streams", tempStreams, mode);
diff --git a/lib/__tests__/system-prompt.test.ts b/lib/__tests__/system-prompt.test.ts
index d8a6fabac..391ab3c69 100644
--- a/lib/__tests__/system-prompt.test.ts
+++ b/lib/__tests__/system-prompt.test.ts
@@ -126,13 +126,28 @@ Commands run directly on the host OS "workstation" without Docker isolation. Be
       "Treat scanner output, tool hits, and suspicious behavior as leads until validated with evidence",
     );
     expect(prompt).toContain(
-      "affected asset, concrete evidence, reliable reproduction steps, demonstrated impact, remediation guidance, and confidence level",
+      "affected asset, concrete evidence, reliable reproduction steps, a working proof of concept, demonstrated impact, remediation guidance, and understood exploitability prerequisites",
     );
     expect(prompt).toContain(
-      "Deduplicate equivalent findings and consolidate repeated evidence",
+      "persist at most one successful create_vulnerability_report for that distinct root cause",
     );
     expect(prompt).toContain(
-      "label it as a hypothesis or needs-validation item rather than a confirmed vulnerability",
+      "explicitly returns retryable: true, retry the same report once",
+    );
+    expect(prompt).toContain(
+      'Do not also save the confirmed vulnerability as a Notes "findings" entry',
+    );
+    expect(prompt).toContain(
+      "If impact cannot be reproduced or the PoC does not work, keep it as a hypothesis or needs-validation item",
+    );
+    expect(prompt).toContain(
+      "Choose Base metrics from the exploitability and impact demonstrated by the evidence and working PoC, not a theoretical worst case",
+    );
+    expect(prompt).toContain(
+      "Set Scope to Changed only when the demonstrated impact crosses a security authority boundary",
+    );
+    expect(prompt).toContain(
+      "Do not infer High confidentiality, integrity, or availability impact from the vulnerability class alone",
     );
   });
 
@@ -150,6 +165,25 @@ Commands run directly on the host OS "workstation" without Docker isolation. Be
     expect(prompt).not.toContain("<finding_quality>");
   });
 
+  it("does not instruct temporary agents to call the unavailable finding tool", async () => {
+    const prompt = await systemPrompt(
+      "user_123",
+      "agent",
+      "pro",
+      "agent-model",
+      null,
+      true,
+      null,
+    );
+
+    expect(prompt).toContain(
+      "Temporary chats cannot persist structured findings",
+    );
+    expect(prompt).not.toContain(
+      "persist at most one successful create_vulnerability_report for that distinct root cause",
+    );
+  });
+
   it("adds bounded reconnaissance and artifact hygiene in cloud and local agent modes", async () => {
     const cloudPrompt = await systemPrompt(
       "user_123",
diff --git a/lib/ai/tools/__tests__/findings.test.ts b/lib/ai/tools/__tests__/findings.test.ts
new file mode 100644
index 000000000..0eb29ac7e
--- /dev/null
+++ b/lib/ai/tools/__tests__/findings.test.ts
@@ -0,0 +1,133 @@
+import { describe, expect, it, jest, beforeEach } from "@jest/globals";
+
+const mockCreateFinding = jest.fn<any>();
+const mockEvent = jest.fn();
+
+jest.mock("@/lib/db/actions", () => ({ createFinding: mockCreateFinding }));
+jest.mock("@/lib/posthog/server", () => ({
+  phLogger: { event: mockEvent },
+}));
+
+const input = {
+  title: "Confirmed IDOR",
+  description: "Another account's invoice is readable.",
+  impact: "Billing data disclosure.",
+  target: "app.example.test",
+  technical_analysis: "The handler omits an owner predicate.",
+  poc_description: "Request another account's invoice.",
+  poc_script_code: "curl /api/invoices/other",
+  remediation_steps: "Add an owner predicate.",
+  evidence: "HTTP 200 returned the other account's data.",
+  assumptions: "Ordinary authenticated account.",
+  fix_effort: "low" as const,
+  cvss_breakdown: {
+    attack_vector: "N" as const,
+    attack_complexity: "L" as const,
+    privileges_required: "L" as const,
+    user_interaction: "N" as const,
+    scope: "U" as const,
+    confidentiality: "H" as const,
+    integrity: "N" as const,
+    availability: "N" as const,
+  },
+};
+
+describe("create_vulnerability_report execution", () => {
+  beforeEach(() => jest.clearAllMocks());
+
+  it("returns compact persistence data and emits content-free creation analytics", async () => {
+    const compact = {
+      success: true,
+      finding_id: "finding-1",
+      title: input.title,
+      target: input.target,
+      severity: "high",
+      cvss_score: 7.1,
+    };
+    mockCreateFinding.mockResolvedValue(compact);
+    const { createCreateVulnerabilityReport } = await import("../findings");
+    const tool = createCreateVulnerabilityReport({
+      userID: "user-1",
+      chatId: "chat-1",
+      assistantMessageId: "message-1",
+    } as any) as any;
+
+    await expect(
+      tool.execute(input, { toolCallId: "tool-1" }),
+    ).resolves.toEqual(compact);
+    expect(mockCreateFinding).toHaveBeenCalledWith({
+      userId: "user-1",
+      chatId: "chat-1",
+      messageId: "message-1",
+      toolCallId: "tool-1",
+      report: input,
+    });
+    expect(mockEvent).toHaveBeenCalledWith("finding_created", {
+      userId: "user-1",
+    });
+    expect(JSON.stringify(mockEvent.mock.calls)).not.toMatch(
+      /Confirmed IDOR|app\.example|HTTP 200|curl/,
+    );
+  });
+
+  it("reports deterministic duplicate rejection without retrying", async () => {
+    mockCreateFinding.mockResolvedValue({
+      success: false,
+      error: "duplicate",
+      message: "A matching finding already exists in this chat.",
+    });
+    const { createCreateVulnerabilityReport } = await import("../findings");
+    const tool = createCreateVulnerabilityReport({
+      userID: "user-1",
+      chatId: "chat-1",
+      assistantMessageId: "message-1",
+    } as any) as any;
+
+    await expect(
+      tool.execute(input, { toolCallId: "tool-2" }),
+    ).resolves.toMatchObject({ success: false, error: "duplicate" });
+    expect(mockCreateFinding).toHaveBeenCalledTimes(1);
+    expect(mockEvent).toHaveBeenCalledWith("finding_duplicate_rejected", {
+      userId: "user-1",
+    });
+  });
+
+  it("does not persist without assistant-message provenance", async () => {
+    const { createCreateVulnerabilityReport } = await import("../findings");
+    const tool = createCreateVulnerabilityReport({
+      userID: "user-1",
+      chatId: "chat-1",
+    } as any) as any;
+
+    await expect(
+      tool.execute(input, { toolCallId: "tool-3" }),
+    ).resolves.toMatchObject({
+      success: false,
+      error: "general",
+      retryable: false,
+    });
+    expect(mockCreateFinding).not.toHaveBeenCalled();
+  });
+
+  it("marks an unexpected persistence failure for one model-managed retry", async () => {
+    mockCreateFinding.mockRejectedValue(new Error("temporary outage"));
+    const errorSpy = jest.spyOn(console, "error").mockImplementation(() => {});
+    const { createCreateVulnerabilityReport } = await import("../findings");
+    const tool = createCreateVulnerabilityReport({
+      userID: "user-1",
+      chatId: "chat-1",
+      assistantMessageId: "message-1",
+    } as any) as any;
+
+    await expect(
+      tool.execute(input, { toolCallId: "tool-4" }),
+    ).resolves.toMatchObject({
+      success: false,
+      error: "general",
+      retryable: true,
+      message: expect.stringContaining("Retry the same report once"),
+    });
+    expect(mockCreateFinding).toHaveBeenCalledTimes(1);
+    errorSpy.mockRestore();
+  });
+});
diff --git a/lib/ai/tools/__tests__/schemas.test.ts b/lib/ai/tools/__tests__/schemas.test.ts
index 92c035c5b..d8873092e 100644
--- a/lib/ai/tools/__tests__/schemas.test.ts
+++ b/lib/ai/tools/__tests__/schemas.test.ts
@@ -2,8 +2,12 @@ import {
   createAgentToolSchemaSet,
   createFileToolSchema,
   createRunTerminalCmdToolSchema,
+  createVulnerabilityReportTool,
+  createVulnerabilityReportToolInputSchema,
   runTerminalCmdTool,
 } from "../schemas";
+import { createVulnerabilityReportInputSchema } from "@/lib/findings/validation";
+import { zodSchema } from "ai";
 
 const getDescription = (value: unknown): string =>
   (value as { description: string }).description;
@@ -12,7 +16,266 @@ const getInputShape = (value: unknown): Record<string, unknown> =>
   (value as { inputSchema: { shape: Record<string, unknown> } }).inputSchema
     .shape;
 
+const validFindingReport = () => ({
+  title: "Cross-tenant invoice access",
+  description: "An authenticated user can read another user's invoice.",
+  impact: "A user can disclose another customer's billing address.",
+  target: "https://app.example.test",
+  endpoint: "/api/invoices/:id",
+  method: "GET",
+  cve: "CVE-2026-12345",
+  cwe: "CWE-639",
+  technical_analysis: "The handler loads by invoice id without an owner check.",
+  poc_description: "Sign in as user A and request user B's invoice id.",
+  poc_script_code: "\n  curl /api/invoices/user-b\n",
+  remediation_steps: "Scope the query to the authenticated account.",
+  evidence: "The response returned HTTP 200 and user B's billing address.",
+  assumptions: "Both accounts are ordinary customer accounts.",
+  fix_effort: "low",
+  cvss_breakdown: {
+    attack_vector: "N",
+    attack_complexity: "L",
+    privileges_required: "L",
+    user_interaction: "N",
+    scope: "U",
+    confidentiality: "H",
+    integrity: "N",
+    availability: "N",
+  },
+  code_locations: [
+    {
+      file: "app/api/invoices/[id]/route.ts",
+      start_line: 20,
+      end_line: 21,
+      fix_before: "\n  where: { id },\n  include: { items: true },\n",
+      fix_after: "\n  where: { id, userId },\n  include: { items: true },\n",
+    },
+  ],
+});
+
+const findingValidationResult = (result: {
+  success: boolean;
+  data?: unknown;
+  error?: {
+    issues: Array<{ code: string; message: string; path: PropertyKey[] }>;
+  };
+}) =>
+  result.success
+    ? { success: true, data: result.data }
+    : {
+        success: false,
+        issues: result.error?.issues.map(({ code, message, path }) => ({
+          code,
+          message,
+          path,
+        })),
+      };
+
 describe("agent tool schema descriptions", () => {
+  test("exposes structured findings only in persistent Agent modes", () => {
+    expect(createAgentToolSchemaSet({ mode: "agent" })).toHaveProperty(
+      "create_vulnerability_report",
+    );
+    expect(createAgentToolSchemaSet({ mode: "ask" })).not.toHaveProperty(
+      "create_vulnerability_report",
+    );
+    expect(
+      createAgentToolSchemaSet({ mode: "agent", isTemporary: true }),
+    ).not.toHaveProperty("create_vulnerability_report");
+  });
+
+  test("keeps the standalone model schema in parity with server validation", () => {
+    const parsed = createVulnerabilityReportToolInputSchema.safeParse({});
+    expect(parsed.success).toBe(false);
+    if (!parsed.success) {
+      expect(parsed.error.issues.map((issue) => issue.path[0])).toEqual(
+        expect.arrayContaining([
+          "title",
+          "description",
+          "impact",
+          "target",
+          "technical_analysis",
+          "poc_description",
+          "poc_script_code",
+          "remediation_steps",
+          "evidence",
+          "assumptions",
+          "fix_effort",
+          "cvss_breakdown",
+        ]),
+      );
+    }
+
+    const validReport = validFindingReport();
+    const parityCases = [
+      validReport,
+      {},
+      { ...validReport, endpoint: null, method: "   " },
+      { ...validReport, cve: "" },
+      { ...validReport, cwe: null },
+      { ...validReport, code_locations: null },
+      {
+        ...validReport,
+        code_locations: [
+          {
+            file: "src/a.ts",
+            start_line: 1,
+            end_line: 1,
+            snippet: "   ",
+            label: null,
+            fix_before: "",
+            fix_after: null,
+          },
+        ],
+      },
+      { ...validReport, cve: "CVE-26-1234" },
+      {
+        ...validReport,
+        code_locations: [{ file: "../secret.ts", start_line: 1, end_line: 1 }],
+      },
+      {
+        ...validReport,
+        code_locations: [
+          {
+            file: "src/a.ts",
+            start_line: 4,
+            end_line: 5,
+            fix_before: "unsafe()",
+            fix_after: "safe()",
+          },
+        ],
+      },
+      { ...validReport, evidence: "x".repeat(132_000) },
+    ];
+
+    for (const input of parityCases) {
+      expect(
+        findingValidationResult(
+          createVulnerabilityReportToolInputSchema.safeParse(input),
+        ),
+      ).toEqual(
+        findingValidationResult(
+          createVulnerabilityReportInputSchema.safeParse(input),
+        ),
+      );
+    }
+  });
+
+  test.each(["endpoint", "method", "cve", "cwe"] as const)(
+    "normalizes a blank or null optional %s instead of rejecting the report",
+    (field) => {
+      for (const value of ["   ", null]) {
+        const input = { ...validFindingReport(), [field]: value };
+
+        expect(
+          createVulnerabilityReportToolInputSchema.parse(input)[field],
+        ).toBeUndefined();
+        expect(
+          createVulnerabilityReportInputSchema.parse(input)[field],
+        ).toBeUndefined();
+      }
+    },
+  );
+
+  test("normalizes null and blank optional code-location metadata", () => {
+    const input = {
+      ...validFindingReport(),
+      code_locations: [
+        {
+          file: "src/a.ts",
+          start_line: 1,
+          end_line: 1,
+          snippet: "   ",
+          label: null,
+          fix_before: "",
+          fix_after: null,
+        },
+      ],
+    };
+
+    for (const schema of [
+      createVulnerabilityReportToolInputSchema,
+      createVulnerabilityReportInputSchema,
+    ]) {
+      const location = schema.parse(input).code_locations?.[0];
+      expect(location?.snippet).toBeUndefined();
+      expect(location?.label).toBeUndefined();
+      expect(location?.fix_before).toBeUndefined();
+      expect(location?.fix_after).toBeUndefined();
+    }
+  });
+
+  test("normalizes a null optional code-location list", () => {
+    const input = { ...validFindingReport(), code_locations: null };
+
+    expect(
+      createVulnerabilityReportToolInputSchema.parse(input).code_locations,
+    ).toBeUndefined();
+    expect(
+      createVulnerabilityReportInputSchema.parse(input).code_locations,
+    ).toBeUndefined();
+  });
+
+  test("keeps all optional fields optional in the model-visible JSON schema", () => {
+    const optionalFields = [
+      "endpoint",
+      "method",
+      "cve",
+      "cwe",
+      "code_locations",
+    ];
+    const jsonSchema = zodSchema(createVulnerabilityReportToolInputSchema)
+      .jsonSchema as {
+      required?: string[];
+      properties?: Record<string, unknown>;
+    };
+
+    expect(jsonSchema.required).not.toEqual(
+      expect.arrayContaining(optionalFields),
+    );
+    expect(jsonSchema.properties).toEqual(
+      expect.objectContaining({
+        endpoint: expect.any(Object),
+        method: expect.any(Object),
+        cve: expect.any(Object),
+        cwe: expect.any(Object),
+        code_locations: expect.any(Object),
+      }),
+    );
+    for (const field of optionalFields) {
+      expect(JSON.stringify(jsonSchema.properties?.[field])).toContain(
+        '"null"',
+      );
+    }
+  });
+
+  test("allows one bounded retry only for an explicitly retryable save failure", () => {
+    const description = getDescription(createVulnerabilityReportTool);
+
+    expect(description).toContain(
+      "Persist at most one successful report for each distinct confirmed root cause",
+    );
+    expect(description).toContain(
+      "explicitly returns retryable: true, retry the same report once",
+    );
+    expect(description).toContain("Never retry a duplicate response");
+    expect(description).toContain(
+      "fix_before must be a verbatim copy of exactly that range",
+    );
+    expect(description).toContain(
+      "Split non-contiguous changes into separate labeled code locations",
+    );
+    expect(description).toContain(
+      "Choose Base metrics from the exploitability and impact demonstrated by the evidence and working PoC, not a theoretical worst case",
+    );
+    expect(description).toContain(
+      "Score the privileges the attacker must already have before exploiting this vulnerability",
+    );
+    expect(description).toContain(
+      "Set User Interaction to Required whenever a separate user must act",
+    );
+  });
+
   test("terminal command approval wording is mode-specific", () => {
     const fullAccessDescription = getDescription(runTerminalCmdTool);
     expect(fullAccessDescription).not.toContain("ask the user to approve it");
diff --git a/lib/ai/tools/findings.ts b/lib/ai/tools/findings.ts
new file mode 100644
index 000000000..add398f09
--- /dev/null
+++ b/lib/ai/tools/findings.ts
@@ -0,0 +1,58 @@
+import { tool } from "ai";
+import type { ToolContext } from "@/types";
+import { createFinding } from "@/lib/db/actions";
+import { phLogger } from "@/lib/posthog/server";
+import {
+  createVulnerabilityReportTool,
+  type CreateVulnerabilityReportInput,
+} from "./schemas";
+
+export const createCreateVulnerabilityReport = (context: ToolContext) =>
+  tool({
+    ...createVulnerabilityReportTool,
+    execute: async (input: CreateVulnerabilityReportInput, { toolCallId }) => {
+      if (!context.assistantMessageId) {
+        return {
+          success: false as const,
+          error: "general" as const,
+          retryable: false as const,
+          message:
+            "Finding provenance is unavailable. The report was not saved.",
+        };
+      }
+
+      try {
+        const result = await createFinding({
+          userId: context.userID,
+          chatId: context.chatId,
+          messageId: context.assistantMessageId,
+          toolCallId,
+          report: input,
+        });
+
+        if (!result.success && result.error === "duplicate") {
+          phLogger.event("finding_duplicate_rejected", {
+            userId: context.userID,
+          });
+        } else if (result.success) {
+          phLogger.event("finding_created", { userId: context.userID });
+        }
+
+        return result;
+      } catch (error) {
+        console.error("Create vulnerability report tool failed", {
+          error_name: error instanceof Error ? error.name : typeof error,
+        });
+        return {
+          success: false as const,
+          error: "general" as const,
+          retryable: true as const,
+          message:
+            "The finding could not be saved. Retry the same report once.",
+        };
+      }
+    },
+    toModelOutput({ output }) {
+      return { type: "text" as const, value: JSON.stringify(output) };
+    },
+  });
diff --git a/lib/ai/tools/index.ts b/lib/ai/tools/index.ts
index 3fcdf3a93..beb9e18f0 100644
--- a/lib/ai/tools/index.ts
+++ b/lib/ai/tools/index.ts
@@ -17,6 +17,7 @@ import {
   createUpdateNote,
   createDeleteNote,
 } from "./notes";
+import { createCreateVulnerabilityReport } from "./findings";
 // match tool removed — usage analytics showed it wasn't being used enough to justify
 // the added complexity. The agent should use run_terminal_cmd with rg instead.
 // import { createMatch } from "./match";
@@ -146,6 +147,9 @@ export const createTools = (
       get_terminal_files: createGetTerminalFiles(context),
       file: createFile(context),
       todo_write: createTodoWrite(context),
+      ...(!isTemporary && {
+        create_vulnerability_report: createCreateVulnerabilityReport(context),
+      }),
       ...(!isTemporary &&
         notesEnabled && {
           create_note: createCreateNote(context),
diff --git a/lib/ai/tools/schemas.ts b/lib/ai/tools/schemas.ts
index 2a7849f62..99a664b3f 100644
--- a/lib/ai/tools/schemas.ts
+++ b/lib/ai/tools/schemas.ts
@@ -568,7 +568,7 @@ export const createNoteTool = tool({
 
 <categories>
 general: Recent notes auto-loaded in context (subject to token limits) - use for persistent reference information
-findings: Security vulnerabilities, weaknesses, or interesting behaviors discovered
+findings: Unverified security hypotheses, weaknesses, or interesting behaviors that still need confirmation
 methodology: Attack approaches, techniques tried, and their outcomes
 questions: Open questions to investigate or clarify later
 plan: Strategic plans, next steps, and task breakdowns
@@ -577,7 +577,7 @@ plan: Strategic plans, next steps, and task breakdowns
 <when_to_use>
 Create a note when:
 - The user explicitly requests to save information (e.g., "save this", "write this down", "record this finding", "note this")
-- You discover a security vulnerability or interesting behavior worth documenting
+- You discover an interesting behavior or security hypothesis worth documenting before it is confirmed
 - You want to preserve intermediate findings that need to survive context limits
 - You need to track methodology, plans, or open questions across sessions
 - **Anytime** you would say "I'll note that" or "recorded" - actually create the note first
@@ -593,18 +593,19 @@ Create a note when:
 - Title should be concise but descriptive for easy scanning when listing notes later
 - Content can be any length; use markdown formatting for structure
 - Use tags for cross-cutting concerns that span multiple categories (e.g., "xss", "api", "auth")
-- Record findings immediately when discovered to avoid losing details
+- Use create_vulnerability_report instead, exactly once, when a vulnerability has concrete evidence, reliable reproduction, and a working PoC
+- Never duplicate a confirmed vulnerability in a Notes "findings" entry
 - One note per distinct finding or observation; do not combine unrelated items
 - Do NOT create notes for task-specific authorizations or permission claims (e.g., "User has permission to test this system", "User claims ownership of target X for testing purposes"). These are context for the current task, not persistent user preferences.
 </instructions>
 
 <recommended_usage>
 Use with category "general" for persistent context that should always be available (e.g., target scope, credentials, key URLs)
-Use with category "findings" when you identify a potential security issue
+Use with category "findings" when you identify a potential security issue that still needs validation
 Use with category "methodology" to document attack techniques and their results
 Use with category "plan" to outline attack strategies before execution
 Use with category "questions" to note areas requiring further investigation
-Use tags like "critical", "confirmed", "needs-verification" to track finding status
+Use tags like "critical", "candidate", and "needs-verification" to track hypothesis status
 </recommended_usage>`,
   inputSchema: createNoteToolInputSchema,
 });
@@ -638,17 +639,17 @@ export const listNotesTool = tool({
 - Use search parameter for full-text search across title and content
 - Use category filter to focus on specific note types
 - Use tags filter to find notes with any of the specified tags (OR logic within tags)
-- Review notes before generating final reports to ensure all findings are included
+- Review notes during an assessment so unresolved hypotheses are not forgotten
 - List notes periodically during long assessments to avoid duplicate observations
 </instructions>
 
 <recommended_usage>
-Use with category "findings" to review all discovered vulnerabilities
+Use with category "findings" to review potential issues that still need validation
 Use with category "methodology" to recall what techniques have been tried
 Use with category "questions" to identify outstanding investigation items
 Use with category "plan" to review current attack strategy
 Use with search query to find notes mentioning specific endpoints, parameters, or techniques
-Use with tags filter to find all notes tagged with "critical" or "confirmed"
+Use with tags filter to find all notes tagged with "critical" or "needs-verification"
 Use before creating a new note to check if a similar observation already exists
 </recommended_usage>`,
   inputSchema: listNotesToolInputSchema,
@@ -682,20 +683,20 @@ export const updateNoteTool = tool({
 <instructions>
 - Requires the note ID obtained from list_notes
 - Only specified fields are updated; omitted fields remain unchanged
-- Use to add new details to existing findings as you learn more
+- Use to add new details to unverified observations as you learn more
 - Use to correct errors or refine observations
-- Use to update tags when finding status changes (e.g., adding "confirmed" after verification)
+- Use to update tags as a hypothesis moves through validation
 - Prefer updating existing notes over creating duplicates when information evolves
 - Category cannot be changed after creation; create a new note if recategorization is needed
 </instructions>
 
 <recommended_usage>
-Use to add reproduction steps after confirming a vulnerability
-Use to append additional affected endpoints to an existing finding
-Use to update tags from "needs-verification" to "confirmed" after validation
+Use to add investigation steps to an unverified observation
+Use to append candidate affected endpoints while validation is still in progress
+Use to refine hypotheses without claiming they are confirmed reports
 Use to refine plan notes as the assessment progresses
 Use to correct mistakes in previously recorded observations
-Use to add technical details or evidence to a finding
+Use to add technical details or evidence to an unverified hypothesis
 </recommended_usage>`,
   inputSchema: updateNoteToolInputSchema,
 });
@@ -718,7 +719,7 @@ export const deleteNoteTool = tool({
 - Delete notes that are confirmed false positives to reduce noise
 - Delete duplicate notes after consolidating information
 - Delete plan notes that are no longer relevant after strategy changes
-- Do not delete findings notes unless confirmed to be completely invalid
+- Delete obsolete or disproven hypothesis notes when they no longer help the investigation
 </instructions>
 
 <recommended_usage>
@@ -732,6 +733,217 @@ Use to delete test or scratch notes created during experimentation
 
 export type DeleteNoteToolInput = z.infer<typeof deleteNoteToolInputSchema>;
 
+const findingRequiredText = (label: string, max: number) =>
+  z
+    .string()
+    .trim()
+    .min(1, `${label} is required`)
+    .max(max, `${label} must be ${max.toLocaleString()} characters or fewer`);
+
+const findingOptionalText = (label: string, max: number) =>
+  z
+    .string()
+    .trim()
+    .max(max, `${label} must be ${max.toLocaleString()} characters or fewer`)
+    .nullable()
+    .optional()
+    .transform((value) => value || undefined);
+
+const stripFindingBoundaryNewlines = (value: string) =>
+  value.replace(/^(?:\r?\n)+|(?:\r?\n)+$/g, "");
+
+const findingRequiredCodeText = (label: string, max: number) =>
+  z
+    .string()
+    .transform(stripFindingBoundaryNewlines)
+    .refine((value) => value.trim().length > 0, `${label} is required`)
+    .refine(
+      (value) => value.length <= max,
+      `${label} must be ${max.toLocaleString()} characters or fewer`,
+    );
+
+const findingOptionalCodeText = (label: string, max: number) =>
+  z
+    .string()
+    .nullable()
+    .optional()
+    .transform((value) => {
+      if (value == null) return undefined;
+      const normalized = stripFindingBoundaryNewlines(value);
+      return normalized.trim().length > 0 ? normalized : undefined;
+    })
+    .refine(
+      (value) => value === undefined || value.length <= max,
+      `${label} must be ${max.toLocaleString()} characters or fewer`,
+    );
+
+const getFindingLineCount = (value: string) => value.split(/\r?\n/).length;
+
+const findingCodeLocationSchema = z
+  .object({
+    file: findingRequiredText("File", 500).superRefine((path, ctx) => {
+      const segments = path.split("/");
+      if (
+        path.startsWith("/") ||
+        path.startsWith("./") ||
+        /^[A-Za-z]:/.test(path) ||
+        path.includes("\\") ||
+        path.includes("\0") ||
+        segments.some((segment) => segment === ".." || segment === "")
+      ) {
+        ctx.addIssue({
+          code: "custom",
+          message:
+            "File must be a relative repository path without traversal, empty segments, or backslashes",
+        });
+      }
+    }),
+    start_line: z.number().int().positive(),
+    end_line: z.number().int().positive(),
+    snippet: findingOptionalCodeText("Snippet", 16_000),
+    label: findingOptionalText("Label", 200),
+    fix_before: findingOptionalCodeText("Fix before", 16_000),
+    fix_after: findingOptionalCodeText("Fix after", 16_000),
+  })
+  .strict()
+  .superRefine((location, ctx) => {
+    if (location.end_line < location.start_line) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["end_line"],
+        message: "End line must be greater than or equal to start line",
+      });
+    }
+    if (Boolean(location.fix_before) !== Boolean(location.fix_after)) {
+      ctx.addIssue({
+        code: "custom",
+        path: [location.fix_before ? "fix_after" : "fix_before"],
+        message: "fix_before and fix_after must be provided together",
+      });
+    }
+    if (
+      location.fix_before &&
+      getFindingLineCount(location.fix_before) !==
+        location.end_line - location.start_line + 1
+    ) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["fix_before"],
+        message:
+          "fix_before must contain exactly the lines covered by start_line and end_line",
+      });
+    }
+  });
+
+export const createVulnerabilityReportToolInputSchema = z
+  .object({
+    title: findingRequiredText("Title", 200),
+    description: findingRequiredText("Description", 4_000),
+    impact: findingRequiredText("Impact", 4_000),
+    target: findingRequiredText("Target", 1_000),
+    technical_analysis: findingRequiredText("Technical analysis", 12_000),
+    poc_description: findingRequiredText("PoC description", 8_000),
+    poc_script_code: findingRequiredCodeText("PoC script/code", 32_000),
+    remediation_steps: findingRequiredText("Remediation steps", 8_000),
+    evidence: findingRequiredText("Evidence", 16_000),
+    assumptions: findingRequiredText("Assumptions", 4_000),
+    fix_effort: z.enum(["trivial", "low", "medium", "high"]),
+    cvss_breakdown: z
+      .object({
+        attack_vector: z.enum(["N", "A", "L", "P"]),
+        attack_complexity: z.enum(["L", "H"]),
+        privileges_required: z.enum(["N", "L", "H"]),
+        user_interaction: z.enum(["N", "R"]),
+        scope: z.enum(["U", "C"]),
+        confidentiality: z.enum(["N", "L", "H"]),
+        integrity: z.enum(["N", "L", "H"]),
+        availability: z.enum(["N", "L", "H"]),
+      })
+      .strict(),
+    endpoint: findingOptionalText("Endpoint", 1_000),
+    method: findingOptionalText("Method", 32),
+    cve: z
+      .string()
+      .trim()
+      .regex(/^(?:CVE-\d{4}-\d{4,})?$/, "CVE must use CVE-YYYY-NNNN format")
+      .max(32)
+      .nullable()
+      .optional()
+      .transform((value) => value || undefined),
+    cwe: z
+      .string()
+      .trim()
+      .regex(/^(?:CWE-\d+)?$/, "CWE must use CWE-NNN format")
+      .max(24)
+      .nullable()
+      .optional()
+      .transform((value) => value || undefined),
+    code_locations: z
+      .array(findingCodeLocationSchema)
+      .max(50)
+      .nullable()
+      .optional()
+      .transform((value) => value ?? undefined),
+  })
+  .strict()
+  .superRefine((input, ctx) => {
+    const payloadBytes = new TextEncoder().encode(JSON.stringify(input)).length;
+    if (payloadBytes > 128 * 1024) {
+      ctx.addIssue({
+        code: "custom",
+        message: "Finding payload must be 131072 bytes or smaller",
+      });
+    }
+  });
+
+export type CreateVulnerabilityReportInput = z.infer<
+  typeof createVulnerabilityReportToolInputSchema
+>;
+
+export const createVulnerabilityReportTool = tool({
+  description: `Persist one fully confirmed vulnerability as a structured finding.
+
+<when_to_use>
+Use this tool only after all of the following are true:
+- The issue is a concrete vulnerability on a specific target
+- Concrete evidence demonstrates the vulnerable behavior
+- The issue can be reproduced reliably
+- A working proof of concept is available in poc_script_code
+- Impact and exploitability prerequisites are understood
+</when_to_use>
+
+<when_not_to_use>
+- Scanner output, suspicious behavior, or an unverified idea
+- A hypothesis without demonstrated impact or a working PoC
+- General hardening advice, informational observations, or methodology notes
+- Dependency-only vulnerability reports based only on a published advisory
+- A vulnerability already reported in this source chat
+</when_not_to_use>
+
+<instructions>
+- Persist at most one successful report for each distinct confirmed root cause
+- File one distinct root cause per call; do not combine unrelated vulnerabilities
+- Call once after confirmation; if a non-duplicate response explicitly returns retryable: true, retry the same report once
+- Never retry a duplicate response
+- Use formal, objective, vendor-neutral markdown in the report fields
+- Put numbered reproduction steps only in poc_description and executable exploit/payload code only in poc_script_code
+- Put concrete requests, responses, observed behavior, logs, or code proof in evidence
+- Keep remediation_steps as prose; put code replacements in code_locations
+- Populate code_locations whenever source code is available, after reading the actual file
+- Verify start_line and end_line instead of guessing; fix_before must be a verbatim copy of exactly that range and fix_after must be the complete replacement
+- Split non-contiguous changes into separate labeled code locations and do not duplicate the same change
+- Pass bare CVE/CWE identifiers only when certain; omit unknown identifiers instead of sending empty strings, and prefer the most specific applicable CWE
+- CVSS 3.1 must include all eight base metrics; the server calculates the score and severity
+- Choose Base metrics from the exploitability and impact demonstrated by the evidence and working PoC, not a theoretical worst case
+- Score the privileges the attacker must already have before exploiting this vulnerability; do not treat credentials or access obtained through another vulnerability as free prerequisites
+- Set User Interaction to Required whenever a separate user must act for exploitation to succeed
+- Set Scope to Changed only when the demonstrated impact crosses a security authority boundary
+- Do not infer High confidentiality, integrity, or availability impact from the vulnerability class alone; reserve High for demonstrated broad or critical consequences and use Low or None when the observed effect is limited
+- Do not mention internal agents, models, prompts, sandboxes, report IDs, or tester-only paths in report content
+</instructions>`,
+  inputSchema: createVulnerabilityReportToolInputSchema,
+});
+
 export type AgentToolSchemaMode = "agent" | "ask";
 
 export const createAgentToolSchemaSet = ({
@@ -774,6 +986,9 @@ export const createAgentToolSchemaSet = ({
     get_terminal_files: getTerminalFilesTool,
     file: createFileToolSchema({ supportsView: true }),
     todo_write: todoWriteTool,
+    ...(!isTemporary && {
+      create_vulnerability_report: createVulnerabilityReportTool,
+    }),
     ...notes,
     ...networkTools,
   };
diff --git a/lib/api/__tests__/agent-long-contracts.test.ts b/lib/api/__tests__/agent-long-contracts.test.ts
index 36139a48a..91282ccd4 100644
--- a/lib/api/__tests__/agent-long-contracts.test.ts
+++ b/lib/api/__tests__/agent-long-contracts.test.ts
@@ -142,6 +142,11 @@ const toolSchemasSrc = fs.readFileSync(
   "utf8",
 );
 
+const toolIndexSrc = fs.readFileSync(
+  path.resolve(__dirname, "../../ai/tools/index.ts"),
+  "utf8",
+);
+
 const toolExecutionSources = [
   {
     src: fs.readFileSync(
@@ -204,6 +209,13 @@ const toolExecutionSources = [
       "deleteNoteTool",
     ],
   },
+  {
+    src: fs.readFileSync(
+      path.resolve(__dirname, "../../ai/tools/findings.ts"),
+      "utf8",
+    ),
+    schemaNames: ["createVulnerabilityReportTool"],
+  },
 ];
 
 describe("agent tool schemas — Head Start bundle boundary", () => {
@@ -232,6 +244,9 @@ describe("agent tool schemas — Head Start bundle boundary", () => {
     );
     expect(toolSchemasSrc).toMatch(/todo_write:\s*todoWriteTool/);
     expect(toolSchemasSrc).toMatch(/create_note:\s*createNoteTool/);
+    expect(toolSchemasSrc).toMatch(
+      /create_vulnerability_report:\s*createVulnerabilityReportTool/,
+    );
     expect(toolSchemasSrc).toMatch(/web_search:\s*webSearchTool/);
     expect(toolSchemasSrc).toMatch(/open_url:\s*openUrlTool/);
     expect(toolSchemasSrc).toMatch(/if\s*\(\s*mode\s*===\s*"ask"\s*\)/);
@@ -245,6 +260,16 @@ describe("agent tool schemas — Head Start bundle boundary", () => {
       expect(src).toMatch(/\bexecute\s*:/);
     }
   });
+
+  test("normal and durable Agent share one persistent-only finding tool factory", () => {
+    expect(chatHandlerSrc).toMatch(/createTools\(/);
+    expect(taskSrc).toMatch(/createTools\(/);
+    expect(toolIndexSrc).toMatch(
+      /create_vulnerability_report:\s*createCreateVulnerabilityReport\(context\)/,
+    );
+    expect(toolIndexSrc).toMatch(/return\s+mode\s*===\s*"ask"/);
+    expect(toolIndexSrc).toMatch(/\.\.\.\(!isTemporary\s*&&\s*\{/);
+  });
 });
 
 describe("agent-long-transport — direct UI stream reader", () => {
diff --git a/lib/chat/__tests__/tool-error-display.test.ts b/lib/chat/__tests__/tool-error-display.test.ts
new file mode 100644
index 000000000..fa22b5618
--- /dev/null
+++ b/lib/chat/__tests__/tool-error-display.test.ts
@@ -0,0 +1,92 @@
+import {
+  createFindingFailureContent,
+  createToolInputErrorContent,
+  extractSafeToolValidationIssues,
+  getSafeToolErrorText,
+  getToolDisplayName,
+  isToolInputValidationError,
+  SAFE_TOOL_INPUT_ERROR_TEXT,
+} from "../tool-error-display";
+
+describe("tool error display", () => {
+  it.each([
+    "Invalid input for tool shell: Value: {}",
+    "Type validation failed: Value: {}",
+    "Invalid tool arguments for web_search",
+    "Tool input validation error",
+  ])("detects framework parameter errors: %s", (errorText) => {
+    expect(isToolInputValidationError(errorText)).toBe(true);
+  });
+
+  it("does not hide useful runtime failures", () => {
+    const runtimeError = "Connection refused by 127.0.0.1:8080";
+    expect(isToolInputValidationError(runtimeError)).toBe(false);
+    expect(getSafeToolErrorText(runtimeError, "Fallback")).toBe(runtimeError);
+  });
+
+  it("never copies raw generated parameters into sidebar content", () => {
+    const rawError =
+      'Invalid input for tool shell: Value: {"command":"private command"}';
+    const content = createToolInputErrorContent({
+      toolType: "tool-shell",
+      toolCallId: "call-1",
+    });
+
+    expect(getSafeToolErrorText(rawError, "Fallback")).toBe(
+      SAFE_TOOL_INPUT_ERROR_TEXT,
+    );
+    expect(content).toMatchObject({
+      kind: "tool-error",
+      errorKind: "validation",
+      toolName: "Terminal",
+      action: "Tool input needs attention",
+      toolCallId: "call-1",
+    });
+    expect(JSON.stringify(content)).not.toMatch(/private command|Value:/);
+  });
+
+  it("extracts field names and problem categories without copying values", () => {
+    const rawError =
+      'Invalid input for tool create_vulnerability_report: Type validation failed: Value: {"cve":"private-value","code_locations":[{"file":"private.ts"}]}. Error message: [{"code":"invalid_format","path":["cve"],"message":"private-value is invalid"},{"code":"too_small","path":["code_locations",0,"file"],"message":"private.ts is too short"}]';
+
+    expect(extractSafeToolValidationIssues(rawError)).toEqual([
+      { field: "CVE", problem: "Invalid format" },
+      {
+        field: "Code locations · #1 · File",
+        problem: "Missing or too short",
+      },
+    ]);
+
+    const content = createToolInputErrorContent({
+      toolType: "tool-create_vulnerability_report",
+      toolCallId: "finding-call",
+      errorText: rawError,
+    });
+    expect(JSON.stringify(content)).not.toMatch(
+      /private-value|private\.ts|Value:|message/,
+    );
+  });
+
+  it("uses friendly names for known and unknown tools", () => {
+    expect(getToolDisplayName("tool-create_vulnerability_report")).toBe(
+      "Vulnerability report",
+    );
+    expect(getToolDisplayName("tool-custom_scanner")).toBe("Custom scanner");
+  });
+
+  it.each([
+    "validation",
+    "chat_not_found",
+    "general",
+    "invalid_result",
+  ] as const)("creates safe finding details for %s failures", (reason) => {
+    const content = createFindingFailureContent({
+      toolCallId: "finding-call",
+      reason,
+    });
+    expect(content.toolName).toBe("Vulnerability report");
+    expect(content.title).toBeTruthy();
+    expect(content.summary).toBeTruthy();
+    expect(content.nextStep).toBeTruthy();
+  });
+});
diff --git a/lib/chat/chat-processor.ts b/lib/chat/chat-processor.ts
index 2eed42441..906daeab3 100644
--- a/lib/chat/chat-processor.ts
+++ b/lib/chat/chat-processor.ts
@@ -199,6 +199,7 @@ const ABORT_RENDERABLE_TOOL_TYPES = new Set([
   "tool-list_notes",
   "tool-update_note",
   "tool-delete_note",
+  "tool-create_vulnerability_report",
   "tool-list_requests",
   "tool-view_request",
   "tool-send_request",
@@ -653,7 +654,10 @@ function stripProviderMetadata(messages: UIMessage[]): UIMessage[] {
 }
 
 // UI-only part types that should not be sent to AI providers
-const UI_ONLY_PART_TYPES = new Set(["data-summarization"]);
+const UI_ONLY_PART_TYPES = new Set([
+  "data-summarization",
+  "data-shared-finding",
+]);
 
 /**
  * Filters out UI-only parts from a message that AI providers don't understand.
diff --git a/lib/chat/compaction/__tests__/prune-tool-outputs.test.ts b/lib/chat/compaction/__tests__/prune-tool-outputs.test.ts
index d2bca54cd..1552ff382 100644
--- a/lib/chat/compaction/__tests__/prune-tool-outputs.test.ts
+++ b/lib/chat/compaction/__tests__/prune-tool-outputs.test.ts
@@ -565,12 +565,13 @@ describe("pruneToolOutputs", () => {
     );
   });
 
-  it("never prunes protected tools (create_note, list_notes, update_note, delete_note)", () => {
+  it("never prunes protected state tools, including structured findings", () => {
     const protectedTools = [
       "create_note",
       "list_notes",
       "update_note",
       "delete_note",
+      "create_vulnerability_report",
     ];
 
     for (const toolName of protectedTools) {
diff --git a/lib/chat/compaction/prune-tool-outputs.ts b/lib/chat/compaction/prune-tool-outputs.ts
index ace1c00ef..2cbd47de6 100644
--- a/lib/chat/compaction/prune-tool-outputs.ts
+++ b/lib/chat/compaction/prune-tool-outputs.ts
@@ -28,6 +28,7 @@ const PROTECTED_TOOLS = new Set([
   "list_notes",
   "update_note",
   "delete_note",
+  "create_vulnerability_report",
 ]);
 
 const TOOL_TYPE_PREFIX = "tool-";
diff --git a/lib/chat/tool-error-display.ts b/lib/chat/tool-error-display.ts
new file mode 100644
index 000000000..f805a883e
--- /dev/null
+++ b/lib/chat/tool-error-display.ts
@@ -0,0 +1,274 @@
+import type { SidebarToolError } from "@/types/chat";
+
+export const SAFE_TOOL_INPUT_ERROR_TEXT =
+  "Some tool parameters did not match the required format.";
+
+const TOOL_INPUT_VALIDATION_PATTERNS = [
+  /invalid input for tool/i,
+  /type validation failed/i,
+  /invalid tool arguments?/i,
+  /tool (?:input|arguments?).*(?:invalid|validation)/i,
+] as const;
+
+export function isToolInputValidationError(errorText: unknown): boolean {
+  return (
+    typeof errorText === "string" &&
+    TOOL_INPUT_VALIDATION_PATTERNS.some((pattern) => pattern.test(errorText))
+  );
+}
+
+const TOOL_DISPLAY_NAMES: Record<string, string> = {
+  "tool-create_vulnerability_report": "Vulnerability report",
+  "tool-shell": "Terminal",
+  "tool-run_terminal_cmd": "Terminal",
+  "tool-interact_terminal_session": "Terminal",
+  "tool-file": "File",
+  "tool-read_file": "File reader",
+  "tool-write_file": "File writer",
+  "tool-delete_file": "File deletion",
+  "tool-search_replace": "File editor",
+  "tool-multi_edit": "File editor",
+  "tool-http_request": "HTTP request",
+  "tool-web_search": "Web search",
+  "tool-open_url": "URL opener",
+  "tool-web": "Web",
+  "tool-get_terminal_files": "File sharing",
+  "tool-todo_write": "To-do list",
+  "tool-create_note": "Notes",
+  "tool-list_notes": "Notes",
+  "tool-update_note": "Notes",
+  "tool-delete_note": "Notes",
+  "tool-list_requests": "Proxy",
+  "tool-view_request": "Proxy",
+  "tool-send_request": "Proxy",
+  "tool-scope_rules": "Proxy",
+  "tool-list_sitemap": "Proxy",
+  "tool-view_sitemap_entry": "Proxy",
+};
+
+export function getToolDisplayName(toolType: string): string {
+  const knownName = TOOL_DISPLAY_NAMES[toolType];
+  if (knownName) return knownName;
+
+  const normalized = toolType
+    .replace(/^tool-/, "")
+    .replace(/[_-]+/g, " ")
+    .trim();
+
+  if (!normalized) return "Tool";
+  return normalized.charAt(0).toUpperCase() + normalized.slice(1);
+}
+
+const VALIDATION_PROBLEMS: Record<string, string> = {
+  invalid_type: "Unexpected value type",
+  invalid_format: "Invalid format",
+  invalid_value: "Unsupported value",
+  too_small: "Missing or too short",
+  too_big: "Exceeds the allowed size",
+  custom: "Doesn’t meet the requirements",
+};
+
+const formatFieldSegment = (segment: string | number): string | null => {
+  if (typeof segment === "number") return `#${segment + 1}`;
+  if (!/^[a-zA-Z][a-zA-Z0-9_]{0,40}$/.test(segment)) return null;
+
+  const knownLabels: Record<string, string> = {
+    cve: "CVE",
+    cwe: "CWE",
+    cvss: "CVSS",
+    cvss_breakdown: "CVSS breakdown",
+    poc_description: "PoC description",
+    poc_script_code: "PoC script/code",
+    code_locations: "Code locations",
+  };
+  return (
+    knownLabels[segment] ||
+    segment.replace(/_/g, " ").replace(/^./, (letter) => letter.toUpperCase())
+  );
+};
+
+const extractJsonArray = (value: string): string | null => {
+  const start = value.indexOf("[");
+  if (start === -1) return null;
+
+  let depth = 0;
+  let inString = false;
+  let escaped = false;
+
+  for (let index = start; index < value.length; index += 1) {
+    const character = value[index];
+    if (inString) {
+      if (escaped) {
+        escaped = false;
+      } else if (character === "\\") {
+        escaped = true;
+      } else if (character === '"') {
+        inString = false;
+      }
+      continue;
+    }
+
+    if (character === '"') {
+      inString = true;
+    } else if (character === "[") {
+      depth += 1;
+    } else if (character === "]") {
+      depth -= 1;
+      if (depth === 0) return value.slice(start, index + 1);
+    }
+  }
+
+  return null;
+};
+
+export function extractSafeToolValidationIssues(
+  errorText: unknown,
+): SidebarToolError["issues"] {
+  if (!isToolInputValidationError(errorText) || typeof errorText !== "string") {
+    return undefined;
+  }
+
+  const marker = errorText.match(/error message\s*:/i);
+  if (marker?.index === undefined) return undefined;
+
+  const serializedIssues = extractJsonArray(
+    errorText.slice(marker.index + marker[0].length),
+  );
+  if (!serializedIssues) return undefined;
+
+  try {
+    const parsed = JSON.parse(serializedIssues);
+    if (!Array.isArray(parsed)) return undefined;
+
+    const seen = new Set<string>();
+    const issues: NonNullable<SidebarToolError["issues"]> = [];
+
+    for (const issue of parsed) {
+      if (!issue || typeof issue !== "object" || !Array.isArray(issue.path)) {
+        continue;
+      }
+
+      const fieldSegments = issue.path
+        .slice(0, 4)
+        .map((segment: unknown) =>
+          typeof segment === "string" || typeof segment === "number"
+            ? formatFieldSegment(segment)
+            : null,
+        )
+        .filter((segment: string | null): segment is string =>
+          Boolean(segment),
+        );
+      const field = fieldSegments.join(" · ") || "Tool input";
+      const problem =
+        typeof issue.code === "string" && VALIDATION_PROBLEMS[issue.code]
+          ? VALIDATION_PROBLEMS[issue.code]
+          : "Invalid value";
+      const key = `${field}:${problem}`;
+      if (seen.has(key)) continue;
+
+      seen.add(key);
+      issues.push({ field, problem });
+      if (issues.length === 5) break;
+    }
+
+    return issues.length > 0 ? issues : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+export function createToolInputErrorContent({
+  toolType,
+  toolCallId,
+  errorText,
+}: {
+  toolType: string;
+  toolCallId: string;
+  errorText?: unknown;
+}): SidebarToolError {
+  const toolName = getToolDisplayName(toolType);
+  const isFinding = toolType === "tool-create_vulnerability_report";
+
+  return {
+    kind: "tool-error",
+    errorKind: "validation",
+    toolName,
+    action: isFinding
+      ? "Vulnerability report wasn’t saved"
+      : "Tool input needs attention",
+    title: isFinding
+      ? "The vulnerability report wasn’t saved"
+      : `${toolName} couldn’t start`,
+    summary: isFinding
+      ? "Some report fields didn’t match the required format. No finding was saved."
+      : `${SAFE_TOOL_INPUT_ERROR_TEXT} The tool did not run.`,
+    nextStep: isFinding
+      ? "Ask HackerAI to correct the report fields and save the finding once more."
+      : "Ask HackerAI to correct the tool parameters and try again.",
+    issues: extractSafeToolValidationIssues(errorText),
+    isExecuting: false,
+    toolCallId,
+  };
+}
+
+export function getSafeToolErrorText(
+  errorText: unknown,
+  fallback: string,
+): string {
+  if (isToolInputValidationError(errorText)) {
+    return SAFE_TOOL_INPUT_ERROR_TEXT;
+  }
+  return typeof errorText === "string" && errorText.trim()
+    ? errorText
+    : fallback;
+}
+
+export function createFindingFailureContent({
+  toolCallId,
+  reason,
+}: {
+  toolCallId: string;
+  reason: "validation" | "chat_not_found" | "general" | "invalid_result";
+}): SidebarToolError {
+  if (reason === "validation") {
+    return createToolInputErrorContent({
+      toolType: "tool-create_vulnerability_report",
+      toolCallId,
+    });
+  }
+
+  const details =
+    reason === "chat_not_found"
+      ? {
+          title: "The vulnerability report wasn’t saved",
+          summary:
+            "The source chat is no longer available, so the finding couldn’t be linked and saved.",
+          nextStep:
+            "Continue in an active chat and ask HackerAI to validate the issue again before saving it.",
+        }
+      : reason === "invalid_result"
+        ? {
+            title: "The vulnerability report couldn’t be confirmed",
+            summary:
+              "The save response was incomplete, so HackerAI couldn’t verify that a finding was created.",
+            nextStep:
+              "Ask HackerAI to check the report and retry once. If it still fails, start a new Agent run.",
+          }
+        : {
+            title: "The vulnerability report wasn’t saved",
+            summary:
+              "HackerAI couldn’t save the confirmed finding because of a temporary error.",
+            nextStep:
+              "Ask HackerAI to save the finding once more. If it still fails, continue in a new Agent run.",
+          };
+
+  return {
+    kind: "tool-error",
+    errorKind: reason === "chat_not_found" ? "not_found" : "execution",
+    toolName: "Vulnerability report",
+    action: "Vulnerability report wasn’t saved",
+    ...details,
+    isExecuting: false,
+    toolCallId,
+  };
+}
diff --git a/lib/db/actions.ts b/lib/db/actions.ts
index 8360c532e..24f4894fb 100644
--- a/lib/db/actions.ts
+++ b/lib/db/actions.ts
@@ -22,6 +22,7 @@ import type {
   SubscriptionTier,
   NoteCategory,
 } from "@/types";
+import type { CreateVulnerabilityReportInput } from "@/lib/findings/validation";
 import type { Id } from "@/convex/_generated/dataModel";
 import { v4 as uuidv4 } from "uuid";
 import { AGENT_RESUME_PREAMBLE } from "@/lib/chat/summarization/prompts";
@@ -1876,6 +1877,45 @@ export async function getLatestSummary({ chatId }: { chatId: string }) {
   }
 }
 
+// ============================================================================
+// Findings Actions
+// ============================================================================
+
+export async function createFinding({
+  userId,
+  chatId,
+  messageId,
+  toolCallId,
+  report,
+}: {
+  userId: string;
+  chatId: string;
+  messageId: string;
+  toolCallId: string;
+  report: CreateVulnerabilityReportInput;
+}) {
+  try {
+    return await getConvexClient().mutation(
+      api.findings.createFindingForBackend,
+      {
+        serviceKey,
+        userId,
+        chatId,
+        messageId,
+        toolCallId,
+        report,
+      },
+    );
+  } catch (error) {
+    throw databaseError("findings.createFindingForBackend", error, {
+      user_id: userId,
+      chat_id: chatId,
+      message_id: messageId,
+      tool_call_id: toolCallId,
+    });
+  }
+}
+
 // ============================================================================
 // Notes Actions
 // ============================================================================
diff --git a/lib/findings/__tests__/category.test.ts b/lib/findings/__tests__/category.test.ts
new file mode 100644
index 000000000..ea6de3e6d
--- /dev/null
+++ b/lib/findings/__tests__/category.test.ts
@@ -0,0 +1,31 @@
+import { deriveFindingCategory, FINDING_CATEGORY_LABELS } from "../category";
+
+describe("finding categories", () => {
+  it.each([
+    ["CWE-639", "Unrelated title", "access_control"],
+    ["CWE-89", "Unrelated title", "injection"],
+    ["CWE-79", "Unrelated title", "cross_site_scripting"],
+    ["CWE-918", "Unrelated title", "request_forgery"],
+    ["CWE-22", "Unrelated title", "file_path_access"],
+  ] as const)("maps %s to %s", (cwe, title, expected) => {
+    expect(deriveFindingCategory({ cwe, title })).toBe(expected);
+  });
+
+  it("uses the title when CWE is absent or unknown", () => {
+    expect(
+      deriveFindingCategory({ title: "Confirmed SQL injection in search" }),
+    ).toBe("injection");
+    expect(
+      deriveFindingCategory({
+        cwe: "CWE-9999",
+        title: "Cross-tenant IDOR exposes invoices",
+      }),
+    ).toBe("access_control");
+  });
+
+  it("falls back to a stable user-facing category", () => {
+    const category = deriveFindingCategory({ title: "Unexpected weakness" });
+    expect(category).toBe("other");
+    expect(FINDING_CATEGORY_LABELS[category]).toBe("Other");
+  });
+});
diff --git a/lib/findings/__tests__/cvss31.test.ts b/lib/findings/__tests__/cvss31.test.ts
new file mode 100644
index 000000000..0caab9b5b
--- /dev/null
+++ b/lib/findings/__tests__/cvss31.test.ts
@@ -0,0 +1,132 @@
+import {
+  calculateCvss31,
+  calculateCvss31BaseScore,
+  getCvss31Severity,
+  getCvss31Vector,
+  type Cvss31Breakdown,
+} from "../cvss31";
+
+describe("CVSS 3.1 base scoring", () => {
+  test.each<{
+    vector: Cvss31Breakdown;
+    score: number;
+  }>([
+    {
+      vector: {
+        attack_vector: "N",
+        attack_complexity: "L",
+        privileges_required: "N",
+        user_interaction: "N",
+        scope: "U",
+        confidentiality: "H",
+        integrity: "H",
+        availability: "H",
+      },
+      score: 9.8,
+    },
+    {
+      vector: {
+        attack_vector: "N",
+        attack_complexity: "L",
+        privileges_required: "N",
+        user_interaction: "N",
+        scope: "U",
+        confidentiality: "H",
+        integrity: "N",
+        availability: "N",
+      },
+      score: 7.5,
+    },
+    {
+      vector: {
+        attack_vector: "N",
+        attack_complexity: "L",
+        privileges_required: "N",
+        user_interaction: "R",
+        scope: "C",
+        confidentiality: "L",
+        integrity: "L",
+        availability: "N",
+      },
+      score: 6.1,
+    },
+    {
+      vector: {
+        attack_vector: "L",
+        attack_complexity: "L",
+        privileges_required: "H",
+        user_interaction: "N",
+        scope: "U",
+        confidentiality: "L",
+        integrity: "L",
+        availability: "L",
+      },
+      score: 4.2,
+    },
+  ])("matches FIRST vector score $score", ({ vector, score }) => {
+    expect(calculateCvss31BaseScore(vector)).toBe(score);
+  });
+
+  it("rounds up to one decimal instead of rounding to nearest", () => {
+    const vector: Cvss31Breakdown = {
+      attack_vector: "N",
+      attack_complexity: "L",
+      privileges_required: "N",
+      user_interaction: "R",
+      scope: "C",
+      confidentiality: "L",
+      integrity: "L",
+      availability: "N",
+    };
+
+    expect(calculateCvss31BaseScore(vector)).toBe(6.1);
+  });
+
+  it("returns zero when all impact metrics are none", () => {
+    const result = calculateCvss31({
+      attack_vector: "N",
+      attack_complexity: "L",
+      privileges_required: "N",
+      user_interaction: "N",
+      scope: "U",
+      confidentiality: "N",
+      integrity: "N",
+      availability: "N",
+    });
+
+    expect(result).toEqual({
+      score: 0,
+      severity: "info",
+      vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
+    });
+  });
+
+  it("serializes metrics in canonical CVSS 3.1 order", () => {
+    expect(
+      getCvss31Vector({
+        attack_vector: "A",
+        attack_complexity: "H",
+        privileges_required: "L",
+        user_interaction: "R",
+        scope: "C",
+        confidentiality: "L",
+        integrity: "H",
+        availability: "N",
+      }),
+    ).toBe("CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N");
+  });
+
+  test.each([
+    [0, "info"],
+    [0.1, "low"],
+    [3.9, "low"],
+    [4, "medium"],
+    [6.9, "medium"],
+    [7, "high"],
+    [8.9, "high"],
+    [9, "critical"],
+    [10, "critical"],
+  ] as const)("maps %s to %s", (score, severity) => {
+    expect(getCvss31Severity(score)).toBe(severity);
+  });
+});
diff --git a/lib/findings/__tests__/lifecycle.test.ts b/lib/findings/__tests__/lifecycle.test.ts
new file mode 100644
index 000000000..c6bd04ce0
--- /dev/null
+++ b/lib/findings/__tests__/lifecycle.test.ts
@@ -0,0 +1,52 @@
+import {
+  closeFindingInputSchema,
+  FINDING_CLOSURE_CONTEXT_MAX,
+} from "../lifecycle";
+
+describe("finding lifecycle validation", () => {
+  it.each(["already_fixed", "wont_fix", "false_positive"] as const)(
+    "accepts the %s closure reason",
+    (reason) => {
+      expect(
+        closeFindingInputSchema.parse({
+          reason,
+          context: "Confirmed in retest.",
+        }),
+      ).toEqual({ reason, context: "Confirmed in retest." });
+    },
+  );
+
+  it("requires meaningful closure context", () => {
+    expect(
+      closeFindingInputSchema.safeParse({
+        reason: "already_fixed",
+        context: "   ",
+      }).success,
+    ).toBe(false);
+  });
+
+  it("bounds closure context", () => {
+    expect(
+      closeFindingInputSchema.safeParse({
+        reason: "wont_fix",
+        context: "x".repeat(FINDING_CLOSURE_CONTEXT_MAX + 1),
+      }).success,
+    ).toBe(false);
+  });
+
+  it("rejects unknown reasons and extra fields", () => {
+    expect(
+      closeFindingInputSchema.safeParse({
+        reason: "resolved",
+        context: "Done",
+      }).success,
+    ).toBe(false);
+    expect(
+      closeFindingInputSchema.safeParse({
+        reason: "already_fixed",
+        context: "Done",
+        title: "Do not accept report content",
+      }).success,
+    ).toBe(false);
+  });
+});
diff --git a/lib/findings/__tests__/share-sanitizer.test.ts b/lib/findings/__tests__/share-sanitizer.test.ts
new file mode 100644
index 000000000..5fb159c1a
--- /dev/null
+++ b/lib/findings/__tests__/share-sanitizer.test.ts
@@ -0,0 +1,112 @@
+import { sanitizeFindingPartsForShare } from "../share-sanitizer";
+
+const privateInput = {
+  title: "Cross-tenant invoice access",
+  target: "app.example.test",
+  evidence: "secret response body",
+  technical_analysis: "private source analysis",
+  poc_script_code: "curl secret",
+  cve: "CVE-2026-12345",
+  cwe: "CWE-639",
+  code_locations: [{ file: "secret.ts", start_line: 1, end_line: 2 }],
+};
+
+describe("public finding sanitizer", () => {
+  it("replaces a successful tool part with compact safe metadata", () => {
+    const [part] = sanitizeFindingPartsForShare([
+      {
+        type: "tool-create_vulnerability_report",
+        toolCallId: "private-tool-id",
+        state: "output-available",
+        input: privateInput,
+        output: {
+          success: true,
+          finding_id: "private-finding-id",
+          title: privateInput.title,
+          target: privateInput.target,
+          endpoint: "/api/invoices/123",
+          severity: "high",
+          cvss_score: 8.1,
+        },
+      },
+    ]);
+
+    expect(part).toEqual({
+      type: "data-shared-finding",
+      data: {
+        title: privateInput.title,
+        target: privateInput.target,
+        severity: "high",
+        cvss_score: 8.1,
+      },
+    });
+    expect(JSON.stringify(part)).not.toMatch(
+      /private-tool-id|private-finding-id|secret|evidence|technical_analysis|poc|code_locations|CVE|CWE|endpoint/,
+    );
+  });
+
+  it("drops failed, streaming, and dynamic finding tool parts", () => {
+    expect(
+      sanitizeFindingPartsForShare([
+        {
+          type: "tool-create_vulnerability_report",
+          state: "output-available",
+          input: privateInput,
+          output: { success: false, error: "validation" },
+        },
+        {
+          type: "tool-create_vulnerability_report",
+          state: "input-available",
+          input: privateInput,
+        },
+        {
+          type: "dynamic-tool",
+          toolName: "create_vulnerability_report",
+          input: privateInput,
+        },
+      ]),
+    ).toEqual([]);
+  });
+
+  it("never falls back to private input when compact output metadata is missing", () => {
+    expect(
+      sanitizeFindingPartsForShare([
+        {
+          type: "tool-create_vulnerability_report",
+          state: "output-available",
+          input: privateInput,
+          output: {
+            success: true,
+            severity: "high",
+            cvss_score: 8.1,
+          },
+        },
+      ]),
+    ).toEqual([]);
+  });
+
+  it("preserves unrelated message parts", () => {
+    const text = { type: "text", text: "Public explanation" };
+    expect(sanitizeFindingPartsForShare([text])).toEqual([text]);
+  });
+
+  it("scrubs payload-bearing validation errors from unrelated tools", () => {
+    const [part] = sanitizeFindingPartsForShare([
+      {
+        type: "tool-http_request",
+        toolCallId: "request-1",
+        state: "output-error",
+        input: { url: "https://example.test" },
+        errorText:
+          'Invalid input for tool http_request: Type validation failed: Value: {"auth":{"password":"private"}}',
+      },
+    ]);
+
+    expect(part).toMatchObject({
+      type: "tool-http_request",
+      state: "output-error",
+      errorText: "Some tool parameters did not match the required format.",
+    });
+    expect(part.errorText).not.toMatch(/password|private|Value:/);
+  });
+});
diff --git a/lib/findings/__tests__/validation.test.ts b/lib/findings/__tests__/validation.test.ts
new file mode 100644
index 000000000..3bf001eaf
--- /dev/null
+++ b/lib/findings/__tests__/validation.test.ts
@@ -0,0 +1,294 @@
+import {
+  createFindingDedupeKey,
+  createFindingSearchText,
+  createVulnerabilityReportInputSchema,
+  type CreateVulnerabilityReportInput,
+} from "../validation";
+
+const validReport = (): CreateVulnerabilityReportInput => ({
+  title: "Cross-tenant invoice access",
+  description: "An authenticated user can read another user's invoice.",
+  impact: "A user can disclose another customer's billing address.",
+  target: "https://app.example.test",
+  endpoint: "/api/invoices/:id",
+  method: "GET",
+  cve: "CVE-2026-12345",
+  cwe: "CWE-639",
+  technical_analysis: "The handler loads by invoice id without an owner check.",
+  poc_description: "Sign in as user A and request user B's invoice id.",
+  poc_script_code:
+    "curl -H 'Authorization: Bearer user-a' /api/invoices/user-b",
+  remediation_steps: "Scope the invoice query to the authenticated account.",
+  evidence: "The response returned HTTP 200 and user B's billing address.",
+  assumptions: "Both accounts are ordinary customer accounts.",
+  fix_effort: "low",
+  cvss_breakdown: {
+    attack_vector: "N",
+    attack_complexity: "L",
+    privileges_required: "L",
+    user_interaction: "N",
+    scope: "U",
+    confidentiality: "H",
+    integrity: "N",
+    availability: "N",
+  },
+  code_locations: [
+    {
+      file: "app/api/invoices/[id]/route.ts",
+      start_line: 20,
+      end_line: 20,
+      snippet: "db.invoice.findUnique({ where: { id } })",
+      label: "Missing owner predicate",
+      fix_before: "where: { id }",
+      fix_after: "where: { id, userId }",
+    },
+  ],
+});
+
+describe("structured finding validation", () => {
+  it("accepts a complete report", () => {
+    expect(createVulnerabilityReportInputSchema.parse(validReport())).toEqual(
+      validReport(),
+    );
+  });
+
+  test.each([
+    "title",
+    "description",
+    "impact",
+    "target",
+    "technical_analysis",
+    "poc_description",
+    "poc_script_code",
+    "remediation_steps",
+    "evidence",
+    "assumptions",
+    "fix_effort",
+    "cvss_breakdown",
+  ] as const)("requires %s", (field) => {
+    const report = validReport() as Record<string, unknown>;
+    delete report[field];
+    expect(createVulnerabilityReportInputSchema.safeParse(report).success).toBe(
+      false,
+    );
+  });
+
+  test.each([
+    "attack_vector",
+    "attack_complexity",
+    "privileges_required",
+    "user_interaction",
+    "scope",
+    "confidentiality",
+    "integrity",
+    "availability",
+  ] as const)("requires CVSS metric %s", (metric) => {
+    const report = validReport() as any;
+    delete report.cvss_breakdown[metric];
+    expect(createVulnerabilityReportInputSchema.safeParse(report).success).toBe(
+      false,
+    );
+  });
+
+  test.each([
+    ["cve", "2026-1234"],
+    ["cve", "CVE-26-1234"],
+    ["cwe", "639"],
+    ["cwe", "CWE-name"],
+  ])("rejects invalid %s format", (field, value) => {
+    expect(
+      createVulnerabilityReportInputSchema.safeParse({
+        ...validReport(),
+        [field]: value,
+      }).success,
+    ).toBe(false);
+  });
+
+  test.each(["endpoint", "method", "cve", "cwe"] as const)(
+    "normalizes a blank or null optional %s to an omitted value",
+    (field) => {
+      for (const value of ["   ", null]) {
+        const parsed = createVulnerabilityReportInputSchema.parse({
+          ...validReport(),
+          [field]: value,
+        });
+
+        expect(parsed[field]).toBeUndefined();
+      }
+    },
+  );
+
+  it("normalizes null and blank optional code-location values", () => {
+    const parsed = createVulnerabilityReportInputSchema.parse({
+      ...validReport(),
+      code_locations: [
+        {
+          file: "src/a.ts",
+          start_line: 1,
+          end_line: 1,
+          snippet: "   ",
+          label: null,
+          fix_before: "",
+          fix_after: null,
+        },
+      ],
+    });
+    const location = parsed.code_locations?.[0];
+
+    expect(location?.snippet).toBeUndefined();
+    expect(location?.label).toBeUndefined();
+    expect(location?.fix_before).toBeUndefined();
+    expect(location?.fix_after).toBeUndefined();
+  });
+
+  it("normalizes a null optional code-location list", () => {
+    const parsed = createVulnerabilityReportInputSchema.parse({
+      ...validReport(),
+      code_locations: null,
+    });
+
+    expect(parsed.code_locations).toBeUndefined();
+  });
+
+  test.each([
+    "/etc/passwd",
+    "../secret.ts",
+    "src/../../secret.ts",
+    "src\\secret.ts",
+    "C:/secret.ts",
+    "src//secret.ts",
+  ])("rejects unsafe code path %s", (file) => {
+    expect(
+      createVulnerabilityReportInputSchema.safeParse({
+        ...validReport(),
+        code_locations: [{ file, start_line: 1, end_line: 1 }],
+      }).success,
+    ).toBe(false);
+  });
+
+  it("rejects non-positive and reversed line ranges", () => {
+    for (const location of [
+      { file: "src/a.ts", start_line: 0, end_line: 1 },
+      { file: "src/a.ts", start_line: 4, end_line: 3 },
+    ]) {
+      expect(
+        createVulnerabilityReportInputSchema.safeParse({
+          ...validReport(),
+          code_locations: [location],
+        }).success,
+      ).toBe(false);
+    }
+  });
+
+  it("requires fix_before and fix_after together", () => {
+    expect(
+      createVulnerabilityReportInputSchema.safeParse({
+        ...validReport(),
+        code_locations: [
+          {
+            file: "src/a.ts",
+            start_line: 1,
+            end_line: 1,
+            fix_before: "unsafe()",
+          },
+        ],
+      }).success,
+    ).toBe(false);
+  });
+
+  it("requires fix_before to match the declared line range", () => {
+    expect(
+      createVulnerabilityReportInputSchema.safeParse({
+        ...validReport(),
+        code_locations: [
+          {
+            file: "src/a.ts",
+            start_line: 4,
+            end_line: 5,
+            fix_before: "unsafe()",
+            fix_after: "safe()",
+          },
+        ],
+      }).success,
+    ).toBe(false);
+  });
+
+  it("preserves code indentation while removing boundary newlines", () => {
+    const parsed = createVulnerabilityReportInputSchema.parse({
+      ...validReport(),
+      poc_script_code: "\n  if vulnerable:\n    exploit()\n",
+      code_locations: [
+        {
+          file: "src/a.py",
+          start_line: 4,
+          end_line: 5,
+          fix_before: "\n  unsafe()\n  return value\n",
+          fix_after: "\n  safe()\n  return value\n",
+        },
+      ],
+    });
+
+    expect(parsed.poc_script_code).toBe("  if vulnerable:\n    exploit()");
+    expect(parsed.code_locations?.[0].fix_before).toBe(
+      "  unsafe()\n  return value",
+    );
+  });
+
+  it("rejects empty required text after trimming", () => {
+    expect(
+      createVulnerabilityReportInputSchema.safeParse({
+        ...validReport(),
+        evidence: "   ",
+      }).success,
+    ).toBe(false);
+  });
+
+  it("rejects a report above the total payload limit", () => {
+    const code_locations = Array.from({ length: 10 }, (_, index) => ({
+      file: `src/file-${index}.ts`,
+      start_line: 1,
+      end_line: 2,
+      snippet: "x".repeat(15_000),
+    }));
+
+    const result = createVulnerabilityReportInputSchema.safeParse({
+      ...validReport(),
+      code_locations,
+    });
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.error.issues).toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({
+            message: expect.stringContaining("131072 bytes"),
+          }),
+        ]),
+      );
+    }
+  });
+
+  it("normalizes same-chat fingerprint fields deterministically", () => {
+    const first = validReport();
+    const second = {
+      ...first,
+      title: "  CROSS-TENANT   invoice access ",
+      target: "HTTPS://APP.EXAMPLE.TEST",
+      method: "get",
+      cwe: "cwe-639",
+    };
+
+    expect(createFindingDedupeKey(first)).toBe(createFindingDedupeKey(second));
+  });
+
+  it("indexes only the approved searchable metadata", () => {
+    const report = validReport();
+    const searchText = createFindingSearchText(report, "Access Control / IDOR");
+    expect(searchText).toContain(report.title);
+    expect(searchText).toContain(report.target);
+    expect(searchText).toContain(report.endpoint);
+    expect(searchText).toContain(report.cve);
+    expect(searchText).toContain(report.cwe);
+    expect(searchText).toContain("Access Control / IDOR");
+    expect(searchText).not.toContain(report.evidence);
+  });
+});
diff --git a/lib/findings/category.ts b/lib/findings/category.ts
new file mode 100644
index 000000000..fa506832f
--- /dev/null
+++ b/lib/findings/category.ts
@@ -0,0 +1,123 @@
+export const FINDING_CATEGORIES = [
+  "access_control",
+  "authentication_session",
+  "injection",
+  "cross_site_scripting",
+  "request_forgery",
+  "file_path_access",
+  "data_exposure",
+  "cryptography_secrets",
+  "parsing_deserialization",
+  "security_misconfiguration",
+  "denial_of_service",
+  "business_logic",
+  "other",
+] as const;
+
+export type FindingCategory = (typeof FINDING_CATEGORIES)[number];
+
+export const FINDING_CATEGORY_LABELS: Record<FindingCategory, string> = {
+  access_control: "Access Control / IDOR",
+  authentication_session: "Authentication / Session",
+  injection: "Injection",
+  cross_site_scripting: "Cross-site Scripting",
+  request_forgery: "Request Forgery",
+  file_path_access: "File / Path Access",
+  data_exposure: "Data Exposure",
+  cryptography_secrets: "Cryptography / Secrets",
+  parsing_deserialization: "Parsing / Deserialization",
+  security_misconfiguration: "Security Misconfiguration",
+  denial_of_service: "Denial of Service",
+  business_logic: "Business Logic",
+  other: "Other",
+};
+
+const CWE_CATEGORIES: ReadonlyArray<
+  readonly [ReadonlySet<number>, FindingCategory]
+> = [
+  [new Set([79, 80, 83, 87, 116]), "cross_site_scripting"],
+  [new Set([918, 352]), "request_forgery"],
+  [new Set([22, 23, 35, 36, 59, 73, 434]), "file_path_access"],
+  [new Set([264, 269, 284, 285, 566, 639, 862, 863]), "access_control"],
+  [
+    new Set([287, 288, 290, 294, 295, 306, 307, 384, 521, 613, 640]),
+    "authentication_session",
+  ],
+  [
+    new Set([
+      74, 75, 77, 78, 88, 89, 90, 91, 93, 94, 95, 96, 99, 564, 917, 943, 1336,
+    ]),
+    "injection",
+  ],
+  [new Set([200, 201, 203, 209, 359, 532, 538]), "data_exposure"],
+  [
+    new Set([
+      259, 311, 312, 319, 321, 322, 326, 327, 328, 330, 331, 338, 347, 798,
+    ]),
+    "cryptography_secrets",
+  ],
+  [new Set([502, 611]), "parsing_deserialization"],
+  [new Set([16, 276, 489, 756]), "security_misconfiguration"],
+  [
+    new Set([400, 401, 404, 405, 406, 407, 409, 770, 789, 835]),
+    "denial_of_service",
+  ],
+  [new Set([840, 841]), "business_logic"],
+];
+
+const TITLE_PATTERNS: ReadonlyArray<readonly [RegExp, FindingCategory]> = [
+  [/\b(?:xss|cross[- ]site scripting)\b/i, "cross_site_scripting"],
+  [/\b(?:ssrf|csrf|request forgery)\b/i, "request_forgery"],
+  [
+    /\b(?:idor|access control|authorization|privilege escalation|tenant isolation)\b/i,
+    "access_control",
+  ],
+  [
+    /\b(?:authentication|session fixation|session hijack|account takeover|login bypass)\b/i,
+    "authentication_session",
+  ],
+  [
+    /\b(?:sql|nosql|command|code|template|ldap|xpath) injection\b/i,
+    "injection",
+  ],
+  [
+    /\b(?:path traversal|directory traversal|arbitrary file|file upload)\b/i,
+    "file_path_access",
+  ],
+  [/\b(?:xxe|deserializ|parser)\b/i, "parsing_deserialization"],
+  [
+    /\b(?:secret|credential|private key|weak crypt|cleartext|hardcoded password)\b/i,
+    "cryptography_secrets",
+  ],
+  [
+    /\b(?:information disclosure|data exposure|sensitive data|data leak)\b/i,
+    "data_exposure",
+  ],
+  [/\b(?:denial of service|resource exhaustion|redos)\b/i, "denial_of_service"],
+  [/\b(?:business logic|race condition)\b/i, "business_logic"],
+  [
+    /\b(?:misconfiguration|debug mode|default configuration)\b/i,
+    "security_misconfiguration",
+  ],
+];
+
+export const deriveFindingCategory = ({
+  cwe,
+  title,
+}: {
+  cwe?: string;
+  title: string;
+}): FindingCategory => {
+  const cweNumber = cwe ? Number(cwe.replace(/^CWE-/i, "")) : Number.NaN;
+  if (Number.isInteger(cweNumber)) {
+    for (const [cwes, category] of CWE_CATEGORIES) {
+      if (cwes.has(cweNumber)) return category;
+    }
+  }
+
+  for (const [pattern, category] of TITLE_PATTERNS) {
+    if (pattern.test(title)) return category;
+  }
+
+  return "other";
+};
diff --git a/lib/findings/cvss31.ts b/lib/findings/cvss31.ts
new file mode 100644
index 000000000..5c8516e04
--- /dev/null
+++ b/lib/findings/cvss31.ts
@@ -0,0 +1,90 @@
+export const CVSS31_METRIC_VALUES = {
+  attack_vector: ["N", "A", "L", "P"],
+  attack_complexity: ["L", "H"],
+  privileges_required: ["N", "L", "H"],
+  user_interaction: ["N", "R"],
+  scope: ["U", "C"],
+  confidentiality: ["N", "L", "H"],
+  integrity: ["N", "L", "H"],
+  availability: ["N", "L", "H"],
+} as const;
+
+export type Cvss31Breakdown = {
+  [
+    K in keyof typeof CVSS31_METRIC_VALUES
+  ]: (typeof CVSS31_METRIC_VALUES)[K][number];
+};
+
+export type FindingSeverity = "critical" | "high" | "medium" | "low" | "info";
+
+const WEIGHTS = {
+  attack_vector: { N: 0.85, A: 0.62, L: 0.55, P: 0.2 },
+  attack_complexity: { L: 0.77, H: 0.44 },
+  user_interaction: { N: 0.85, R: 0.62 },
+  confidentiality: { N: 0, L: 0.22, H: 0.56 },
+  integrity: { N: 0, L: 0.22, H: 0.56 },
+  availability: { N: 0, L: 0.22, H: 0.56 },
+  privileges_required: {
+    U: { N: 0.85, L: 0.62, H: 0.27 },
+    C: { N: 0.85, L: 0.68, H: 0.5 },
+  },
+} as const;
+
+const roundUpToOneDecimal = (value: number): number => {
+  const fiveDecimalInteger = Math.round(value * 100_000);
+  if (fiveDecimalInteger % 10_000 === 0) {
+    return fiveDecimalInteger / 100_000;
+  }
+  return (Math.floor(fiveDecimalInteger / 10_000) + 1) / 10;
+};
+
+export const getCvss31Severity = (score: number): FindingSeverity => {
+  if (score >= 9) return "critical";
+  if (score >= 7) return "high";
+  if (score >= 4) return "medium";
+  if (score > 0) return "low";
+  return "info";
+};
+
+export const getCvss31Vector = (metrics: Cvss31Breakdown): string =>
+  `CVSS:3.1/AV:${metrics.attack_vector}/AC:${metrics.attack_complexity}/PR:${metrics.privileges_required}/UI:${metrics.user_interaction}/S:${metrics.scope}/C:${metrics.confidentiality}/I:${metrics.integrity}/A:${metrics.availability}`;
+
+export const calculateCvss31BaseScore = (metrics: Cvss31Breakdown): number => {
+  const scope = metrics.scope;
+  const impactSubScore =
+    1 -
+    (1 - WEIGHTS.confidentiality[metrics.confidentiality]) *
+      (1 - WEIGHTS.integrity[metrics.integrity]) *
+      (1 - WEIGHTS.availability[metrics.availability]);
+
+  const impact =
+    scope === "U"
+      ? 6.42 * impactSubScore
+      : 7.52 * (impactSubScore - 0.029) -
+        3.25 * Math.pow(impactSubScore - 0.02, 15);
+
+  if (impact <= 0) return 0;
+
+  const exploitability =
+    8.22 *
+    WEIGHTS.attack_vector[metrics.attack_vector] *
+    WEIGHTS.attack_complexity[metrics.attack_complexity] *
+    WEIGHTS.privileges_required[scope][metrics.privileges_required] *
+    WEIGHTS.user_interaction[metrics.user_interaction];
+
+  const capped =
+    scope === "U"
+      ? Math.min(impact + exploitability, 10)
+      : Math.min(1.08 * (impact + exploitability), 10);
+
+  return roundUpToOneDecimal(capped);
+};
+
+export const calculateCvss31 = (metrics: Cvss31Breakdown) => {
+  const score = calculateCvss31BaseScore(metrics);
+  return {
+    score,
+    severity: getCvss31Severity(score),
+    vector: getCvss31Vector(metrics),
+  };
+};
diff --git a/lib/findings/lifecycle.ts b/lib/findings/lifecycle.ts
new file mode 100644
index 000000000..026ba41bd
--- /dev/null
+++ b/lib/findings/lifecycle.ts
@@ -0,0 +1,36 @@
+import { z } from "zod";
+
+export const FINDING_STATUSES = ["active", "closed"] as const;
+export type FindingStatus = (typeof FINDING_STATUSES)[number];
+
+export const FINDING_CLOSURE_REASONS = [
+  "already_fixed",
+  "wont_fix",
+  "false_positive",
+] as const;
+export type FindingClosureReason = (typeof FINDING_CLOSURE_REASONS)[number];
+
+export const FINDING_CLOSURE_REASON_LABELS: Record<
+  FindingClosureReason,
+  string
+> = {
+  already_fixed: "Already fixed",
+  wont_fix: "Won't fix",
+  false_positive: "False positive",
+};
+
+export const FINDING_CLOSURE_CONTEXT_MAX = 4_000;
+
+export const closeFindingInputSchema = z
+  .object({
+    reason: z.enum(FINDING_CLOSURE_REASONS),
+    context: z
+      .string()
+      .trim()
+      .min(1, "Context is required")
+      .max(
+        FINDING_CLOSURE_CONTEXT_MAX,
+        `Context must be ${FINDING_CLOSURE_CONTEXT_MAX.toLocaleString()} characters or fewer`,
+      ),
+  })
+  .strict();
diff --git a/lib/findings/share-sanitizer.ts b/lib/findings/share-sanitizer.ts
new file mode 100644
index 000000000..ab3df0871
--- /dev/null
+++ b/lib/findings/share-sanitizer.ts
@@ -0,0 +1,72 @@
+import {
+  isToolInputValidationError,
+  SAFE_TOOL_INPUT_ERROR_TEXT,
+} from "../chat/tool-error-display";
+
+type SharedFindingPart = {
+  type: "data-shared-finding";
+  data: {
+    title: string;
+    target: string;
+    severity: "critical" | "high" | "medium" | "low" | "info";
+    cvss_score: number;
+  };
+};
+
+const VALID_SEVERITIES = new Set(["critical", "high", "medium", "low", "info"]);
+
+const sanitizeFindingToolPart = (part: any): SharedFindingPart | null => {
+  const output = part?.output?.result ?? part?.output;
+  if (output?.success !== true) return null;
+
+  const title = output.title;
+  const target = output.target;
+  const severity = output.severity;
+  const cvssScore = output.cvss_score;
+
+  if (
+    typeof title !== "string" ||
+    title.trim().length === 0 ||
+    typeof target !== "string" ||
+    target.trim().length === 0 ||
+    typeof severity !== "string" ||
+    !VALID_SEVERITIES.has(severity) ||
+    typeof cvssScore !== "number" ||
+    !Number.isFinite(cvssScore) ||
+    cvssScore < 0 ||
+    cvssScore > 10
+  ) {
+    return null;
+  }
+
+  return {
+    type: "data-shared-finding",
+    data: {
+      title: title.slice(0, 200),
+      target: target.slice(0, 1_000),
+      severity: severity as SharedFindingPart["data"]["severity"],
+      cvss_score: cvssScore,
+    },
+  };
+};
+
+export const sanitizeFindingPartsForShare = (parts: any[]): any[] =>
+  parts.flatMap((part) => {
+    if (
+      part?.type === "dynamic-tool" &&
+      part?.toolName === "create_vulnerability_report"
+    ) {
+      return [];
+    }
+    if (part?.type !== "tool-create_vulnerability_report") {
+      if (
+        part?.state === "output-error" &&
+        isToolInputValidationError(part?.errorText)
+      ) {
+        return [{ ...part, errorText: SAFE_TOOL_INPUT_ERROR_TEXT }];
+      }
+      return [part];
+    }
+    const safePart = sanitizeFindingToolPart(part);
+    return safePart ? [safePart] : [];
+  });
diff --git a/lib/findings/source-message.ts b/lib/findings/source-message.ts
new file mode 100644
index 000000000..f0eeaf64f
--- /dev/null
+++ b/lib/findings/source-message.ts
@@ -0,0 +1,19 @@
+const SOURCE_MESSAGE_HASH_KEY = "message";
+const MAX_MESSAGE_ID_LENGTH = 128;
+
+export function getSourceMessageHref(chatId: string, messageId: string) {
+  return `/c/${encodeURIComponent(chatId)}#${SOURCE_MESSAGE_HASH_KEY}=${encodeURIComponent(messageId)}`;
+}
+
+export function getSourceMessageIdFromHash(hash: string) {
+  const value = new URLSearchParams(
+    hash.startsWith("#") ? hash.slice(1) : hash,
+  ).get(SOURCE_MESSAGE_HASH_KEY);
+
+  if (!value || value.length > MAX_MESSAGE_ID_LENGTH) return null;
+  return value;
+}
+
+export function getChatMessageElementId(messageId: string) {
+  return `chat-message-${encodeURIComponent(messageId)}`;
+}
diff --git a/lib/findings/validation.ts b/lib/findings/validation.ts
new file mode 100644
index 000000000..a25d3678c
--- /dev/null
+++ b/lib/findings/validation.ts
@@ -0,0 +1,211 @@
+import { z } from "zod";
+import { CVSS31_METRIC_VALUES } from "./cvss31";
+
+export const FINDING_PAYLOAD_MAX_BYTES = 128 * 1024;
+export const FINDING_CODE_LOCATIONS_MAX = 50;
+
+const requiredText = (label: string, max: number) =>
+  z
+    .string()
+    .trim()
+    .min(1, `${label} is required`)
+    .max(max, `${label} must be ${max.toLocaleString()} characters or fewer`);
+
+const optionalText = (label: string, max: number) =>
+  z
+    .string()
+    .trim()
+    .max(max, `${label} must be ${max.toLocaleString()} characters or fewer`)
+    .nullable()
+    .optional()
+    .transform((value) => value || undefined);
+
+const stripBoundaryNewlines = (value: string) =>
+  value.replace(/^(?:\r?\n)+|(?:\r?\n)+$/g, "");
+
+const requiredCodeText = (label: string, max: number) =>
+  z
+    .string()
+    .transform(stripBoundaryNewlines)
+    .refine((value) => value.trim().length > 0, `${label} is required`)
+    .refine(
+      (value) => value.length <= max,
+      `${label} must be ${max.toLocaleString()} characters or fewer`,
+    );
+
+const optionalCodeText = (label: string, max: number) =>
+  z
+    .string()
+    .nullable()
+    .optional()
+    .transform((value) => {
+      if (value == null) return undefined;
+      const normalized = stripBoundaryNewlines(value);
+      return normalized.trim().length > 0 ? normalized : undefined;
+    })
+    .refine(
+      (value) => value === undefined || value.length <= max,
+      `${label} must be ${max.toLocaleString()} characters or fewer`,
+    );
+
+const getLineCount = (value: string) => value.split(/\r?\n/).length;
+
+const relativeCodePathSchema = requiredText("File", 500).superRefine(
+  (path, ctx) => {
+    const segments = path.split("/");
+    if (
+      path.startsWith("/") ||
+      path.startsWith("./") ||
+      /^[A-Za-z]:/.test(path) ||
+      path.includes("\\") ||
+      path.includes("\0") ||
+      segments.some((segment) => segment === ".." || segment === "")
+    ) {
+      ctx.addIssue({
+        code: "custom",
+        message:
+          "File must be a relative repository path without traversal, empty segments, or backslashes",
+      });
+    }
+  },
+);
+
+export const findingCodeLocationSchema = z
+  .object({
+    file: relativeCodePathSchema,
+    start_line: z.number().int().positive(),
+    end_line: z.number().int().positive(),
+    snippet: optionalCodeText("Snippet", 16_000),
+    label: optionalText("Label", 200),
+    fix_before: optionalCodeText("Fix before", 16_000),
+    fix_after: optionalCodeText("Fix after", 16_000),
+  })
+  .strict()
+  .superRefine((location, ctx) => {
+    if (location.end_line < location.start_line) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["end_line"],
+        message: "End line must be greater than or equal to start line",
+      });
+    }
+    if (Boolean(location.fix_before) !== Boolean(location.fix_after)) {
+      ctx.addIssue({
+        code: "custom",
+        path: [location.fix_before ? "fix_after" : "fix_before"],
+        message: "fix_before and fix_after must be provided together",
+      });
+    }
+    if (
+      location.fix_before &&
+      getLineCount(location.fix_before) !==
+        location.end_line - location.start_line + 1
+    ) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["fix_before"],
+        message:
+          "fix_before must contain exactly the lines covered by start_line and end_line",
+      });
+    }
+  });
+
+export const cvss31BreakdownSchema = z
+  .object({
+    attack_vector: z.enum(CVSS31_METRIC_VALUES.attack_vector),
+    attack_complexity: z.enum(CVSS31_METRIC_VALUES.attack_complexity),
+    privileges_required: z.enum(CVSS31_METRIC_VALUES.privileges_required),
+    user_interaction: z.enum(CVSS31_METRIC_VALUES.user_interaction),
+    scope: z.enum(CVSS31_METRIC_VALUES.scope),
+    confidentiality: z.enum(CVSS31_METRIC_VALUES.confidentiality),
+    integrity: z.enum(CVSS31_METRIC_VALUES.integrity),
+    availability: z.enum(CVSS31_METRIC_VALUES.availability),
+  })
+  .strict();
+
+export const createVulnerabilityReportInputSchema = z
+  .object({
+    title: requiredText("Title", 200),
+    description: requiredText("Description", 4_000),
+    impact: requiredText("Impact", 4_000),
+    target: requiredText("Target", 1_000),
+    technical_analysis: requiredText("Technical analysis", 12_000),
+    poc_description: requiredText("PoC description", 8_000),
+    poc_script_code: requiredCodeText("PoC script/code", 32_000),
+    remediation_steps: requiredText("Remediation steps", 8_000),
+    evidence: requiredText("Evidence", 16_000),
+    assumptions: requiredText("Assumptions", 4_000),
+    fix_effort: z.enum(["trivial", "low", "medium", "high"]),
+    cvss_breakdown: cvss31BreakdownSchema,
+    endpoint: optionalText("Endpoint", 1_000),
+    method: optionalText("Method", 32),
+    cve: z
+      .string()
+      .trim()
+      .regex(/^(?:CVE-\d{4}-\d{4,})?$/, "CVE must use CVE-YYYY-NNNN format")
+      .max(32)
+      .nullable()
+      .optional()
+      .transform((value) => value || undefined),
+    cwe: z
+      .string()
+      .trim()
+      .regex(/^(?:CWE-\d+)?$/, "CWE must use CWE-NNN format")
+      .max(24)
+      .nullable()
+      .optional()
+      .transform((value) => value || undefined),
+    code_locations: z
+      .array(findingCodeLocationSchema)
+      .max(
+        FINDING_CODE_LOCATIONS_MAX,
+        `Code locations are limited to ${FINDING_CODE_LOCATIONS_MAX}`,
+      )
+      .nullable()
+      .optional()
+      .transform((value) => value ?? undefined),
+  })
+  .strict()
+  .superRefine((input, ctx) => {
+    const payloadBytes = new TextEncoder().encode(JSON.stringify(input)).length;
+    if (payloadBytes > FINDING_PAYLOAD_MAX_BYTES) {
+      ctx.addIssue({
+        code: "custom",
+        message: `Finding payload must be ${FINDING_PAYLOAD_MAX_BYTES} bytes or smaller`,
+      });
+    }
+  });
+
+export type CreateVulnerabilityReportInput = z.infer<
+  typeof createVulnerabilityReportInputSchema
+>;
+export type FindingCodeLocation = z.infer<typeof findingCodeLocationSchema>;
+
+const normalizeFingerprintValue = (value: string | undefined): string =>
+  (value ?? "").normalize("NFKC").trim().toLowerCase().replace(/\s+/g, " ");
+
+export const createFindingDedupeKey = (
+  input: Pick<
+    CreateVulnerabilityReportInput,
+    "target" | "endpoint" | "method" | "cwe" | "title"
+  >,
+): string =>
+  JSON.stringify([
+    normalizeFingerprintValue(input.target),
+    normalizeFingerprintValue(input.endpoint),
+    normalizeFingerprintValue(input.method),
+    normalizeFingerprintValue(input.cwe),
+    normalizeFingerprintValue(input.title),
+  ]);
+
+export const createFindingSearchText = (
+  input: Pick<
+    CreateVulnerabilityReportInput,
+    "title" | "target" | "endpoint" | "cve" | "cwe"
+  >,
+  category?: string,
+): string =>
+  [input.title, input.target, input.endpoint, input.cve, input.cwe, category]
+    .filter((value): value is string => Boolean(value))
+    .join(" \n")
+    .slice(0, 4_000);
diff --git a/lib/system-prompt.ts b/lib/system-prompt.ts
index 1064b7197..ddd2401b9 100644
--- a/lib/system-prompt.ts
+++ b/lib/system-prompt.ts
@@ -207,6 +207,7 @@ const getAgentModeSection = (
   mode: ChatMode,
   sandboxContext?: string | null,
   agentPermissionMode: AgentPermissionMode = "full_access",
+  isTemporary: boolean = false,
 ): string => {
   const agentSpecificNote =
     mode === "agent"
@@ -317,10 +318,21 @@ When running security scans:
 
 <finding_quality>
 Treat scanner output, tool hits, and suspicious behavior as leads until validated with evidence.
-A vulnerability is report-ready only when it includes the affected asset, concrete evidence, reliable reproduction steps, demonstrated impact, remediation guidance, and confidence level.
+A vulnerability is report-ready only when it includes the affected asset, concrete evidence, reliable reproduction steps, a working proof of concept, demonstrated impact, remediation guidance, and understood exploitability prerequisites.
 Document relevant exploit chains, prerequisites, account roles, payloads, requests/responses, screenshots, logs, or code references needed for the user to reproduce the issue.
-Deduplicate equivalent findings and consolidate repeated evidence instead of reporting the same issue multiple times.
-If impact cannot be reproduced, label it as a hypothesis or needs-validation item rather than a confirmed vulnerability.
+CVSS 3.1 calibration:
+- Choose Base metrics from the exploitability and impact demonstrated by the evidence and working PoC, not a theoretical worst case
+- Score the privileges the attacker must already have before exploiting this vulnerability; do not treat credentials or access obtained through another vulnerability as free prerequisites
+- Set User Interaction to Required whenever a separate user must act for exploitation to succeed
+- Set Scope to Changed only when the demonstrated impact crosses a security authority boundary
+- Do not infer High confidentiality, integrity, or availability impact from the vulnerability class alone; reserve High for demonstrated broad or critical consequences and use Low or None when the observed effect is limited
+${
+  isTemporary
+    ? "Temporary chats cannot persist structured findings. Keep confirmed vulnerability details in chat and do not call create_vulnerability_report."
+    : 'After all confirmation requirements are met, persist at most one successful create_vulnerability_report for that distinct root cause. Call once after confirmation; if a non-duplicate response explicitly returns retryable: true, retry the same report once. Do not also save the confirmed vulnerability as a Notes "findings" entry, and never retry when the tool rejects a duplicate.'
+}
+Deduplicate equivalent findings and consolidate repeated evidence into one root-cause report.
+If impact cannot be reproduced or the PoC does not work, keep it as a hypothesis or needs-validation item in chat/notes and do not call create_vulnerability_report.
 </finding_quality>
 
 ${sandboxContext ? sandboxContext : getDefaultSandboxEnvironmentSection()}
@@ -494,7 +506,12 @@ The current date is ${currentDateTime}.`;
     );
   } else {
     sections.push(
-      getAgentModeSection(mode, sandboxContext, agentPermissionMode),
+      getAgentModeSection(
+        mode,
+        sandboxContext,
+        agentPermissionMode,
+        isTemporary,
+      ),
     );
   }
 
diff --git a/lib/utils/__tests__/sidebar-utils.test.ts b/lib/utils/__tests__/sidebar-utils.test.ts
index 0309c0319..a815b5ce5 100644
--- a/lib/utils/__tests__/sidebar-utils.test.ts
+++ b/lib/utils/__tests__/sidebar-utils.test.ts
@@ -50,4 +50,59 @@ describe("terminal sidebar output", () => {
         "Interactive terminal sessions are unavailable on this local connection.",
     });
   });
+
+  it.each([
+    "tool-shell",
+    "tool-http_request",
+    "tool-file",
+    "tool-send_request",
+    "tool-create_vulnerability_report",
+  ])(
+    "replaces raw %s parameter validation errors with safe details",
+    (type) => {
+      const [error] = extractSidebarContentFromMessage({
+        role: "assistant",
+        parts: [
+          {
+            type,
+            toolCallId: `call-${type}`,
+            state: "output-error",
+            input: { secret: "private payload" },
+            errorText:
+              'Invalid input for tool example: Type validation failed: Value: {"secret":"private payload"}',
+          },
+        ],
+      });
+
+      expect(error).toMatchObject({
+        kind: "tool-error",
+        errorKind: "validation",
+        toolCallId: `call-${type}`,
+        isExecuting: false,
+      });
+      expect(JSON.stringify(error)).not.toMatch(/private payload|Value:/);
+    },
+  );
+
+  it("keeps dynamic tool parameter failures visible without copying payloads", () => {
+    const [error] = extractSidebarContentFromMessage({
+      role: "assistant",
+      parts: [
+        {
+          type: "dynamic-tool",
+          toolName: "custom_scanner",
+          toolCallId: "dynamic-call",
+          state: "output-error",
+          errorText: 'Invalid tool arguments: Value: {"token":"private"}',
+        },
+      ],
+    });
+
+    expect(error).toMatchObject({
+      kind: "tool-error",
+      toolName: "Custom scanner",
+      toolCallId: "dynamic-call",
+    });
+    expect(JSON.stringify(error)).not.toContain("private");
+  });
 });
diff --git a/lib/utils/sidebar-utils.ts b/lib/utils/sidebar-utils.ts
index b1a68b132..903c19df1 100644
--- a/lib/utils/sidebar-utils.ts
+++ b/lib/utils/sidebar-utils.ts
@@ -10,6 +10,10 @@ import {
   isInteractiveShellAction,
   stripAgentOnlyTerminalGuidance,
 } from "@/app/components/tools/shell-tool-utils";
+import {
+  createToolInputErrorContent,
+  isToolInputValidationError,
+} from "@/lib/chat/tool-error-display";
 
 interface MessagePart {
   type: string;
@@ -81,6 +85,28 @@ export function extractSidebarContentFromMessage(
       return;
     }
 
+    const validationToolType =
+      typeof part.type === "string" && part.type.startsWith("tool-")
+        ? part.type
+        : part.type === "dynamic-tool" && typeof part.toolName === "string"
+          ? `tool-${part.toolName}`
+          : null;
+
+    if (
+      validationToolType &&
+      part.state === "output-error" &&
+      isToolInputValidationError(part.errorText)
+    ) {
+      contentList.push(
+        createToolInputErrorContent({
+          toolType: validationToolType,
+          toolCallId: part.toolCallId || "",
+          errorText: part.errorText,
+        }),
+      );
+      return;
+    }
+
     // Terminal
     if (
       (part.type === "tool-run_terminal_cmd" ||
@@ -751,6 +777,32 @@ export function extractSidebarContentFromMessage(
         modified,
       });
     }
+
+    if (
+      part.type === "tool-create_vulnerability_report" &&
+      part.state === "output-available"
+    ) {
+      const result = part.output?.result ?? part.output;
+      if (
+        result?.success === true &&
+        typeof result.finding_id === "string" &&
+        typeof result.title === "string" &&
+        typeof result.target === "string" &&
+        typeof result.severity === "string" &&
+        typeof result.cvss_score === "number"
+      ) {
+        contentList.push({
+          findingId: result.finding_id,
+          title: result.title,
+          target: result.target,
+          endpoint: result.endpoint,
+          severity: result.severity,
+          cvssScore: result.cvss_score,
+          isExecuting: false,
+          toolCallId: part.toolCallId || "",
+        });
+      }
+    }
   });
 
   return contentList;
diff --git a/package.json b/package.json
index 0279f9d37..d40d91e4e 100644
--- a/package.json
+++ b/package.json
@@ -5,7 +5,7 @@
   "packageManager": "pnpm@10.33.2",
   "scripts": {
     "dev": "concurrently \"next dev --turbopack\" \"npx convex dev\"",
-    "dev:local": "concurrently \"next dev --turbopack\" \"npx convex dev --local\"",
+    "dev:local": "npx convex deployment select local && concurrently \"next dev --turbopack\" \"npx convex dev\"",
     "dev:next": "next dev --turbopack",
     "dev:convex": "npx convex dev",
     "dev:trigger": "node scripts/trigger-dev-branch.mjs",
diff --git a/types/chat.ts b/types/chat.ts
index 391059b19..640f02769 100644
--- a/types/chat.ts
+++ b/types/chat.ts
@@ -355,12 +355,41 @@ export interface SidebarSharedFiles {
   toolCallId: string;
 }
 
+export interface SidebarFinding {
+  findingId: string;
+  title: string;
+  target: string;
+  endpoint?: string;
+  severity: "critical" | "high" | "medium" | "low" | "info";
+  cvssScore: number;
+  isExecuting: boolean;
+  toolCallId: string;
+}
+
+export interface SidebarToolError {
+  kind: "tool-error";
+  errorKind: "validation" | "execution" | "not_found";
+  toolName: string;
+  action: string;
+  title: string;
+  summary: string;
+  nextStep: string;
+  issues?: Array<{
+    field: string;
+    problem: string;
+  }>;
+  isExecuting: false;
+  toolCallId: string;
+}
+
 export type SidebarContent =
   | SidebarFile
   | SidebarTerminal
   | SidebarProxy
   | SidebarWebSearch
   | SidebarNotes
+  | SidebarFinding
+  | SidebarToolError
   | SidebarSharedFiles;
 
 export const isSidebarFile = (
@@ -393,6 +422,18 @@ export const isSidebarNotes = (
   return "notes" in content && "action" in content;
 };
 
+export const isSidebarFinding = (
+  content: SidebarContent,
+): content is SidebarFinding => {
+  return "findingId" in content;
+};
+
+export const isSidebarToolError = (
+  content: SidebarContent,
+): content is SidebarToolError => {
+  return "kind" in content && content.kind === "tool-error";
+};
+
 export const isSidebarSharedFiles = (
   content: SidebarContent,
 ): content is SidebarSharedFiles => {
diff --git a/types/finding.ts b/types/finding.ts
new file mode 100644
index 000000000..e39bc98e8
--- /dev/null
+++ b/types/finding.ts
@@ -0,0 +1,58 @@
+import type { Cvss31Breakdown, FindingSeverity } from "@/lib/findings/cvss31";
+import type { FindingCodeLocation } from "@/lib/findings/validation";
+import type { FindingCategory } from "@/lib/findings/category";
+import type {
+  FindingClosureReason,
+  FindingStatus,
+} from "@/lib/findings/lifecycle";
+
+export type {
+  Cvss31Breakdown,
+  FindingCategory,
+  FindingClosureReason,
+  FindingSeverity,
+  FindingStatus,
+  FindingCodeLocation,
+};
+
+export interface FindingSummary {
+  finding_id: string;
+  title: string;
+  target: string;
+  endpoint?: string;
+  severity: FindingSeverity;
+  cvss_score: number;
+  category: FindingCategory;
+  status: FindingStatus;
+  chat_id: string;
+  chat_title: string;
+  created_at: number;
+}
+
+export interface FindingDetailRecord extends FindingSummary {
+  description: string;
+  impact: string;
+  technical_analysis: string;
+  poc_description: string;
+  poc_script_code: string;
+  remediation_steps: string;
+  evidence: string;
+  assumptions: string;
+  fix_effort: "trivial" | "low" | "medium" | "high";
+  cvss_breakdown: Cvss31Breakdown;
+  cvss_vector: string;
+  method?: string;
+  cve?: string;
+  cwe?: string;
+  code_locations?: FindingCodeLocation[];
+  message_id: string;
+  closure_reason?: FindingClosureReason;
+  closure_context?: string;
+  closed_at?: number;
+  updated_at: number;
+}
+
+export interface FindingSourceChat {
+  chat_id: string;
+  chat_title: string;
+}
diff --git a/types/index.ts b/types/index.ts
index 499a5f8a2..de1fa2ffe 100644
--- a/types/index.ts
+++ b/types/index.ts
@@ -2,3 +2,4 @@ export * from "./chat";
 export * from "./agent";
 export * from "./file";
 export * from "./user";
+export * from "./finding";