Finding closure

Work only against [authorized target] and only within the rules of engagement you have been given. If a finding cannot be tested within that scope, mark it as such and move on rather than widening the scope yourself. Take the findings one at a time, highest impact first. For each, reproduce the issue exactly as reported and record what you observed. If it does not reproduce, say so and stop work on it — the report may be stale, environment-specific, or wrong, and that is worth knowing before anyone writes code. Where it does reproduce, identify the underlying cause rather than the surface symptom, and note which other places share that cause. A fix that only closes the reported instance leaves the same bug everywhere else it lives. Propose the smallest change that removes the cause. Apply it, then re-run the original reproduction unchanged. The finding is closed only when the same steps no longer produce the same result, and the regression tests still pass. Where the fix cannot be applied — the cause is in a third party, or the change is larger than this pass — record the compensating control that reduces exposure in the meantime and who owns getting it fixed properly. Stop and ask before changing production, altering authentication or authorization logic, or accepting a finding as won’t-fix. Finish when every finding is reproduced-and-closed, not-reproducible, or deferred with a compensating control and a named owner. Report each finding with its reproduction evidence, the cause, the change, and the post-fix result.