Original practice work / Synthetic desk review / 01
When the finding outruns the evidence
Three fictional findings, reviewed for unsupported impact, inconsistent severity and vague remediation. A practical example of making a report more precise without making its conclusions louder.
The question
Can a reader distinguish what a report actually demonstrates from what its author assumes? In this example, an order-data exposure was described as account takeover, a “Medium” finding carried a 9.8 score, and missing CSP was presented as proof of XSS.
The problem is not simply wording. An inflated or internally inconsistent conclusion can send remediation in the wrong direction.
The review method
- Trace each impact statement to the fictional evidence provided.
- Separate observed behavior, inferred impact and untested conditions.
- Identify rating and scoring inconsistencies without silently inventing missing metrics.
- Describe remediation at the relevant control boundary, then define what a retest would need to demonstrate.
Before and after
| Original claim | Evidence-supported revision | Still unknown |
|---|---|---|
| “Account takeover” | A cross-account order-read condition, bounded to the fictional request and response. | Credential changes, write access and population-wide exposure were not tested. |
| “Medium / 9.8” | Flag the mismatch; request and review the scoring vector and environmental context. | A complete, justified score cannot be reconstructed from a label alone. |
| “Missing CSP proves XSS” | A missing defense-in-depth header does not, by itself, demonstrate script injection. | An injection path and executable browser behavior would need separate evidence. |
A bounded finding reads differently
Instead of claiming control of another account, the revised example states the observed cross-account data access and records its boundaries. It does not quietly convert an order read into a demonstrated password change or a write operation.
The remediation discussion follows that same boundary: enforce server-side authorization for each requested object and define an authorized retest across relevant users, roles and access decisions.
The artifact
The three comparisons on this page are the complete practice example. Each separates the observed condition from untested impact. Use the report QA worksheet to apply these checks to your own authorized work.
The takeaway
A narrower conclusion is not a weaker report. When it matches the evidence, it gives the reader something more useful: a technical condition they can understand, a claim they can examine and a next check they can define.