Read a finding from the claim to the evidence

Establish the assessment context

Read the tested environment, dates, build, account roles, and exclusions. The same request can have different significance under different permissions. A production hostname in a screenshot does not establish which environment was authorized or which identity performed the action.

NIST SP 800-115 provides assessment context for planning, conducting, and interpreting technical security testing. Use the engagement's actual scope and records to determine what a particular report supports.

Follow one complete evidence chain

For an illustrative cross-tenant export issue, establish the synthetic export's owner, the requesting account's role, the executed request, and the returned content. A successful status code alone does not prove that another tenant's data was retrieved. The body may be an error page, an empty job acknowledgement, or a permitted shared record.

Where the result is asynchronous, connect the request to the final authoritative state or output. Preserve the identifiers and timestamps needed to assess that connection while redacting secrets and unrelated personal information.

Read the reproduction as a controlled procedure

A reproduction should identify prerequisites, actions, expected and observed results, and meaningful constraints. The engineering owner should be able to locate the affected behavior and formulate a regression test. Commands or screenshots without context may be insufficient even when the underlying claim is real.

OWASP's authorization guidance helps explain the rule in the tenant example. The example in this reference remains illustrative; it is not a customer incident or a completed product benchmark.

Separate the observed result from wider impact

A report can establish that a particular test identity read a synthetic record. Broader claims about every tenant, historical compromise, or financial loss require their own support. State the boundary of the observation and the investigation needed to assess additional consequences.

Decide what is accepted and what remains open

Use distinct states for an accepted finding, unresolved hypothesis, excluded workflow, and incomplete reproduction. Every unresolved item needs a next step and an owner. A disagreement with the severity label should not erase the evidence supporting the underlying behavior.