Anatomy of a finding report engineers actually close.

A finding is a piece of persuasion. The engineer who has to fix it did not commission the test, was not in the room, and has three other tickets. Everything you include is either helping them decide or actively costing you their attention.

The parts that carry weight

1. 01One sentence stating the impact on this business, not the vulnerability class. 'An unauthenticated attacker can read every customer record' beats 'SQL injection (time-based)'.
2. 02The vector, shown rather than summarised — the environment and privilege requirements tell the engineer whether this is reachable from their deployment.
3. 03A reproduction the engineer can run without you. If it needs a Burp repeater and a specific cookie, it is not reproducible; it is a story.
4. 04Evidence they can verify independently: the raw request, the raw response, the delta.
5. 05A remediation that is specific enough to be reviewed.

The parts that are usually noise

• A screenshot of a terminal showing your tool's output. Nobody can diff it against production.
• A generic OWASP reference link in place of an explanation.
• The full raw response dumped inline when it is forty lines of HTML.
• The scanner's internal check name, which means nothing outside your platform.

What to include about remediation

Rank remediation guidance by what the engineer can actually do. A prepared statement is a change they can make. A note about 'parameterised queries' is a homework assignment. Where a WAF rule is a stopgap and the real fix is a query change, say both, and label the stopgap — an engineer who discovers that for themselves later will stop trusting your next finding.

“The screenshot was in someone's downloads folder. That sentence cost us three engineer-weeks of re-litigation.”

M. Das, Director of Engineering

The test for a finding is simple: hand it to an engineer who has never heard of the vulnerability class, on a Tuesday, without you in the room. If they can reproduce it, believe it, and start work — the finding is good. Everything else is documentation.