Penetration test finding template

Claim

Finding ID:

Title naming the actor, action, and failed boundary:

Status:

Assessment context

Target environment and build:

Assessment date and tester:

Affected asset, route, or component:

Account role and prerequisites:

Expected security rule:

Authorization or scope reference:

Evidence and reproduction

Controlled test data or object ownership:

Reproduction steps:

1. 2. 3.

Redacted request and response references:

Observed result:

Expected result:

Independent verification and date:

Impact and limits

Observed capability:

Affected data or operation:

Unverified consequences requiring further assessment:

Material limitations:

Severity rationale:

CVSS version, vector, and score, if used:

Local priority and rationale:

Repair record

Engineering owner:

Recommended correction:

Related paths to review:

Temporary mitigation and remaining work:

Acceptance criteria for permitted behavior:

Acceptance criteria for denied behavior:

Target date or risk-review date:

Retest

Retest date and reviewer:

Build and scope retested:

Evidence references:

Outcome and unresolved work:

Decision owner and next review, if risk is accepted: