Close a finding with a comparable retest

Define acceptance before reviewing the patch

State the intended security rule and the behavior that must remain possible. For an illustrative tenant boundary, an account may access its own synthetic export while remaining unable to retrieve another tenant's export. Both conditions matter when assessing a repair.

The engineering owner should identify where the rule is enforced and which interfaces rely on it. Hiding a button is not the same as preventing an unauthorized request. OWASP's Authorization Cheat Sheet supplies the underlying permission-check principles.

Retain the original conditions

Keep the target build, effective role, object ownership, relevant configuration, and accepted reproduction evidence. For the retest, identify the deployed change and any difference in those conditions. A changed account or reset environment can alter the outcome independently of the patch.

For state-changing workflows, prepare synthetic data and record the reset. Do not let the result of an earlier permitted operation be mistaken for a new unauthorized action, or a stale failed state be mistaken for a successful repair.

Check the target's actual result

Repeat the relevant action and inspect its authoritative outcome. An error message may accompany an unintended change; a success message may acknowledge a job that later rejects the operation. Preserve the record needed to distinguish those cases.

Then test the corresponding permitted behavior where it is part of the acceptance condition. A blanket outage can block the original exploit while still leaving the application unusable. That is not the same as an accepted authorization repair.

Leave incomplete work visible

If the environment is unavailable or the account no longer reaches the affected behavior, the result is incomplete. Record the blocker, owner, and next step. Where the organization accepts residual risk, preserve the decision and its scope separately from the technical retest status.

Share the appropriate record

Different recipients may need different detail. Preserve the underlying evidence under suitable access controls, and provide the bounded summary needed for the actual decision. Redact credentials and unrelated personal information without removing the context required to understand the finding.