Turn a finding into a report someone can fix
Evidence, impact and retesting: what should remain after the assessment.
Name the violation precisely
“API security issue” does not define a useful task. Identify the action and boundary instead: “a user in one organization can read another organization’s test document.” The title should convey the issue without requiring the reader to inspect the entire traffic log.
Make reproduction self-contained
Specify the environment, role, preconditions, minimal steps and expected result. Include redacted requests and responses. Another specialist should be able to reproduce the observation without guessing which data or permissions the tester had.
Separate risk from assumptions
Describe the confirmed impact and the conditions needed to trigger it. Label an untested chain of consequences as a hypothesis. Severity should account for the affected data, scenario accessibility and the product’s actual context.
Close the loop with a retest
Tie the recommendation to the root cause. After remediation, repeat the original scenario and related variations that may be affected. Record the version, date and retest outcome; keep remaining limitations visible in the final document.