Find the cause.
A review can identify code that handles information unsafely or a permission that appears too broad. The next question is whether the relevant part of the system can be reached and used in that way.
The explanation should connect the concern to the application, the affected users and the conditions that matter.
Check the effect.
Where the agreed scope allows it, a controlled test can show how the system behaves. For example, it may reveal that one account can read information intended for another.
A useful finding states what the evidence supports, how serious the issue is and what the team should change.
About this note
Examples are illustrative. Testing takes place only within an authorised scope.
All field notes