Report a Wrong Result

No scanner is right every time. When Dralvia gets a verdict wrong, you are usually the first to know: it is your domain, your supplier, or the link that actually took one of your staff to a fake sign-in page.

Report a Wrong Result lets you say so, in either direction, from the scan result itself. A security analyst reviews every report by hand and you see what they decided.

It is available on every plan, including the free tier. Telling us we are wrong is not a paid feature.

The two directions

You are telling us	What it means
Flagged, but it is safe	We raised the risk on something you know is legitimate. Our result was too harsh.
Marked safe, but it is malicious	We did not raise the risk on something that turned out to be malicious. Our result was too soft.

The second one is the one we learn the most from. Nothing else tells us what we failed to catch.

How it works

1. Open a scan result in your workspace and find Think this result is wrong? below the findings.
2. Choose the direction and write one sentence explaining what you know that we did not.
3. Send it. Your report is now Submitted.
4. A security analyst re-examines the evidence we collected for that scan.
5. The report becomes Confirmed (the analyst agreed with you) or Rejected (they did not, and their note explains why).

You can see the status and the analyst's note on the same scan result at any time.

Your scan result does not change

Reporting a result never edits, rescores, or deletes it. The scan stays exactly as it was served, because it is the record of what we told you at the time, and rewriting that record would destroy the evidence you may need later (for an insurer, an auditor, or your own incident review).

What a confirmed report changes is our measurement of how good the detection is, and what we correct next.

What we do with a confirmed report

A confirmed report is recorded as ground truth about that scan, with your reason and the analyst's confirmation attached to it. We use it to measure detection quality honestly: how often we are too harsh, how often we are too soft, and whether a change actually improves either number.

Limits worth knowing

• You can only report scans your own workspace ran. You cannot file a report against someone else's result.
• One report per scan, per workspace. If you have already reported a scan, you will see where that report stands rather than a new form.
• A report is a claim until an analyst confirms it. This is deliberate. If an unreviewed report counted as truth, the operator of a phishing site could clear their own site simply by reporting it. Every report is reviewed by a human before it carries any weight.
• Reporting requires an account. A report has to be attached to a workspace so an analyst can come back to you with what they found. Guest scans stay free; reporting one means creating a free account first.
• Rejections always come with a reason. An analyst cannot reject a report without writing a note you can read.

API

Submit a report

POST /api/scan/verdict-report

Field	Required	Description
public_id	yes (or scan_id)	The public id of the scan you are reporting.
scan_id	yes (or public_id)	The numeric id of the scan, if you do not have the public id.
report_type	yes	false_positive or missed_threat.
reason	yes	Why the result is wrong. At least 10 characters, at most 2000.

Returns 201 with the created report, including its status and an explanation of what that status means.

List your reports

GET /api/scan/verdict-reports?status=submitted&limit=50

Returns every report your workspace has filed, newest first, each with its status, the verdict that was disputed, and the analyst's note if one has been written. status is optional and accepts submitted, confirmed, or rejected.

Errors

Status	Error	What it means
400	invalid_report_type	report_type must be false_positive or missed_threat.
400	invalid_reason	The explanation is missing, too short, or too long.
400	scan_required	Neither public_id nor scan_id was supplied.
401	unauthorized	The request carried no workspace context.
404	scan_not_found	The scan does not exist in your workspace.
409	already_reported	Your workspace has already reported this scan. The response includes that report and its current status.