> For the complete documentation index, see [llms.txt](https://docs.devarmor.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devarmor.com/modules/design-reviewer/review-output-and-findings.md).

# Review Output & Findings

What a completed design review contains.

A completed design review surfaces two categories of findings:

| Field                         | Description                                                                         |
| ----------------------------- | ----------------------------------------------------------------------------------- |
| **Potential Security Issues** | Potential issues, threats, and abuse cases identified based on the proposed design. |
| **Security Requirements**     | Properties the implementation must satisfy, derived from your threat model.         |

High-criticality items are security requirements; lower-criticality items are recommendations.

## Supporting detail

Depending on the design being reviewed, DevArmor also tracks:

* **Abuse cases** — specific ways the feature's use cases could be exploited, each tied to a use case and the access level required to carry it out.
* **Use cases** — the intended interactions between an actor and the feature.
* **Assets** — the things of value the design touches, that a threat actor might target.
* **Pen tests** — suggested penetration test scopes, each targeting a specific component, that can be pushed to a bug bounty program or pentest consultant.
* **Policies and rules** — the security policies applicable to the design, and, if configured, the [AI Guardrails](/modules/code-reviewer/ai-guardrails.md) rules that enforce them in code.

## Turning findings into work

Findings become tasks the same way threat model output does — see [Implement Threat Model Results](/modules/threat-modeler/implement-threat-model-results.md). Tasks created from a design review can be pushed to Jira or linked to an existing Jira issue, and stay in sync automatically when the linked issue's title, priority, status, or labels change.