> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/sast-and-sca/prezero/customization/policies/findings-descriptions.md).

# Customize the descriptions of findings

This article will show you how to create a policy that customizes the description of individual findings in Qwiet AI by Harness.

You'll need the `CONCLUSION` and `WHEN` blocks for the categories you want to modify (e.g., `xss-to-header`); you can obtain these from Qwiet.

```
IMPORT io.shiftleft/default
IMPORT io.shiftleft/defaultdict

CONCLUSION xss-to-header = FLOW IO (http OR $http) -> IO (httpHeader)
WHEN CONCLUSION xss-to-header => EMIT {
     title: "XSS: HTTP data to header {{via `$paramname`}} {{in `$methodname`}}",
     category: "a7-XSS",
     description: "Data from HTTP request parameters is stored in HTTP headers. Unless the string is validated, this may result in a XSS attack.

## Countermeasures

This vulnerability can be prevented by using input sanitization/validation techniques (e.g., allowlisting) on the HTTP data before using it inside another HTTP header.

## Internal help

Visit the slack channel #team-xss to learn more about XSS. We have many resources in our [Confluence page](http://example.com) on XSS.

## Additional information

**[CWE-79](https://cwe.mitre.org/data/definitions/79.html)**

**[OWASP-A7](https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A7-Cross-Site_Scripting_(XSS))**",
     score: "8.0",
     vulnerability_description: "XSS",
     owasp_link: "https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A7-Cross-Site_Scripting_(XSS)",
     link: "https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A7-Cross-Site_Scripting_(XSS)",
     cwe_link: "https://cwe.mitre.org/data/definitions/79.html"
}
```

![](/files/CRrxFX9wuboXxDrdB2dv)

![](/files/DfHDmRpYn5HJOmhRtTva) ![](/files/P5vj8JOtHNJWVEvAqKym)

Now, Qwiet AI by Harness will use your custom descriptions when reporting its findings. Note that the description field supports Markdown syntax.