# Security finding template

- Finding ID:
- Title:
- Severity / rationale:
- Confidence: CONFIRMED / LIKELY / UNVERIFIED
- State: OPEN / FIXED-UNVERIFIED / VERIFIED / RISK-ACCEPTED
- Affected revision, component, file and line range:
- Actor/preconditions/required permissions:
- Trust boundary and root cause:
- Data assets at risk (test-only evidence):
- Sanitized reproduction steps (safe staging only):
- Expected result vs actual observed result:
- Proof evidence links and timestamps (no real secrets/PII):
- CWE / OWASP ASVS 5.0 / WSTG mappings (only if verified):
- Remediation and alternate affected paths:
- Reproduction test ID (failing pre-fix):
- Post-fix test IDs and exact outcome:
- Residual risk, owner, reviewer and sign-off: