# Security finding and retest worksheet

Published by WarHoundAI. Updated: 20 October 2026.
Source guide: https://warhoundai.com/blog/actionable-security-findings-remediation/
Worked example: https://warhoundai.com/blog/api-authorization-testing-saas/#worked-example

This is an editable human review worksheet, not a BloodHound API schema, a real scan result, a certification, or permission to test an application. Use only approved targets and synthetic records. Replace bracketed fields; never paste passwords, session cookies, private keys or customer data.

## 1. Scope and accountability

- Finding ID: [internal identifier]
- Title: [specific operation and boundary]
- Reporter and date: [team/contact and date]
- Authorized assessment reference: [approval or scope document]
- Environment and approved target: [staging URL or service]
- Observed deployment version: [commit or release]
- Account roles: [synthetic identities and relevant memberships]
- Finding owner: [person responsible for tracking remediation]
- State: [unverified observation / confirmed / fixed in code / deployed / retested / inconclusive]

## 2. Expected permission rule

[State the actor, resource, action and tenant relationship. Include the legitimate behavior that must remain possible. A login alone does not establish permission to a particular record.]

## 3. Safe reproduction and observation

1. [Create disposable fixtures in the approved environment.]
2. [Confirm legitimate access using a test identity.]
3. [Exercise the forbidden operation using another controlled identity.]
4. [Record the response and any side effects.]
5. [Clean up fixtures according to the approved scope.]

- Known fixture identifiers: [synthetic references only]
- Sanitized request: [method, relevant path and non-secret parameters]
- Sanitized response: [status plus the minimum evidence needed]
- Observed side effects: [none / describe / not checked]
- Evidence reference: [restricted storage link, not raw credentials]
- Evidence retention and deletion owner: [approved period and owner]

## 4. Impact and uncertainty

- Confirmed boundary crossed: [confidentiality / integrity / availability]
- Confirmed affected operation and fixtures: [what the evidence establishes]
- Prerequisites and privileges: [what an actor must already have]
- Related paths not tested: [exports, attachments, jobs, other environments]
- Potential reach requiring investigation: [separate inference from observation]
- Severity rationale: [exposure, data sensitivity, prerequisites and business context]

Do not infer a production compromise from a synthetic staging result. If evidence is inconclusive, record that explicitly.

## 5. Proposed remediation

- Trusted layer responsible for enforcement: [server function / shared authorization / database policy]
- Intended correction: [behavior and constraints, not only a suggested patch]
- Related operations requiring review: [where the same rule applies]
- Implementation owner and target date: [owner / date]
- Fix reference: [reviewed change]
- Deployed version and environment: [release / environment / date]

A merged change is not proof that the deployed boundary has been corrected.

## 6. Retest matrix

Replace the illustrative rows with your application's documented policy. Expected outcomes below are not measured results; fill in the actual result and evidence after authorized testing.

| Check | Expected outcome | Actual result | Sanitized evidence |
| --- | --- | --- | --- |
| Authorized member reads its own synthetic workspace record | Allowed | [not run] | [reference] |
| Other-workspace member requests that same record | Denied without private data or side effects | [not run] | [reference] |
| Other-workspace member reads its own record | Allowed | [not run] | [reference] |
| Signed-out client requests a private record | Denied | [not run] | [reference] |
| Member retries after membership is removed | Denied | [not run] | [reference] |

- Retest version, environment and date: [values]
- Reviewer: [person]
- Regression check reference: [test at the layer owning the rule]
- Residual uncertainty: [remaining gaps]
- Final disposition: [verified for the tested cases / inconclusive / follow-up required]

Passing these cases does not establish complete application security.