Findings, evidence and remediation

Read the evidence, confidence, affected asset and test conditions. An AI-written explanation is a summary; the observation supports the claim.

Separate a static indicator, a reproducible validation and a confirmed business impact. A sensitive MCP parameter name warrants investigation; it does not prove arbitrary command execution.

A deterministic validator decides whether an observation is a finding and how strong it is. Validated means the signal reproduces but does not by itself show exploitation, for example a database error string or a reflected test marker. Proven means the signal is the weakness itself, such as an off-origin redirect or an exposed secrets file, or that a class-appropriate test confirmed it, such as a true/false SQL injection comparison.

Language-model judgement can flag a suspicion but never raises a finding above suspected. Severity and confidence are separate: a validated high-severity finding still deserves urgent review.

Redact credentials and personal data before sharing. Retain enough context for an authorised reviewer to understand the result.

Record the change addressing the cause, rather than only the ticket status. Confirm that the prohibited behaviour stops and ordinary permitted behaviour still works.

Hashes and signatures support integrity. They do not independently prove comprehensive coverage or correct interpretation.