Security Finding Evidence and Disposition

Security Finding Evidence and Disposition

Security reviews often combine source concerns, test observations, and assumptions about deployment. Record these separately so a risk score does not outrun the evidence.

Classify the claim

For each finding, record:

Evidence layer	Question
Source	Does the code contain the behavior described?
Runtime reachability	Can a supported identity and request path reach it?
Impact	Does the request expose data, cross a boundary, or cause a protected side effect?
Deployment	Does the supported deployment expose the affected route or service?

A source-level concern does not establish runtime exploitability. A test that fails before reaching the application establishes an environment blocker, not a pass or a vulnerability result.

Keep dispositions distinct

Use explicit labels such as confirmed, not reproduced, environment blocked, invalid for the supported boundary, accepted risk, and fixed. Include the date, confidence, environment, exact evidence, policy owner, and the reason for any disposition change. Link a later result to the earlier record instead of silently replacing it.

For accepted risks, record the scope, rationale, owner, and condition that should reopen review. Do not treat an accepted risk as invalid or remediated.

Verify supported paths

Trace the supported login and API paths, then inspect deployed reachability and effective configuration before describing a finding as externally exploitable. Do not extend a finding to an identity provider or route that the application does not support.

Investigation examples

The security review for Waste Plus separated unsupported BCSC probes from supported BCeID and IDIR behavior. It also recorded an authorization test that failed before HTTP as environment-blocked, rather than treating it as a negative result. Later reports used different dispositions for AUTHZ-006; that discrepancy needs explicit reconciliation before either statement becomes a general conclusion.

The investigation recorded disposable dev/test Oracle plaintext transport and browser-readable Cognito tokens as accepted risks. Those decisions do not establish that the risks are acceptable in another system or environment.

Evidence sources

• evidence/replication-evidence-standard.md
• final/remaining-findings-triage-2026-10-01.md
• final/authorization-scope-final-report.md
• final/remediation-completion-report.md
• final/security-coverage-test-plan-2026-10-05.md
• frozen-contract.md