The evidence standard

One finding, all the way through.

Every claim we make carries exactly one label, and every label means one specific thing. Here is what each one buys you — and one finding traced from the request to the regulator.

The five labels

• ConfirmedReproduced on a second run. Raw logs ship with it.
• ObservedSeen once, or uncontrolled. Rated conservatively.
• Surface provenThe write landed. Execution never followed.
• Verified secureAttacked and held. Listed so you don't regress it.
• GapA probe we couldn't close. Named, not omitted.

The dot repeats the label without relying on colour — filled means proven end to end, half means partly determined, hollow means not determined.

What Confirmed looks like in full

DATA-01 · Broken object-level authorization Confirmed

One endpoint trusted an account ID straight from the URL. No token, no cookie, no ownership check — and the download links it handed back needed none either.

Blast radius

1. One endpointthe defect itself
2. Any account IDincremented by hand
3. 95 customersa ceiling we chose, not a limit
4. Anyone, for 7 dayslinks outlive the account that made them

For your engineers

• Authorize the object, not the route — ownership checked server-side on every fetch.
• Signed links measured in minutes, bound to the session that asked.
• Regression test: tenant A's session fetching tenant B's report must return 403.

Three changes. One sprint.

For your regulator

• GDPR Art. 32 security of processing, Art. 25 protection by design.
• Art. 33 notification assessment triggers if those reports carry non-public personal data.
• India DPDPA Sec. 8(5) reasonable security safeguards.

Ceiling: €20M or 4% of global turnover.

For your buyer

• The questionnaire answer, in one line: object-level authorization is enforced server-side and independently retested.
• Retest dated, signed, and attached to the claim — not a checkbox.

The reason the deal moves.

Watch the same finding reconstructed at the speed it happened — request, fan-out, and what survived the revoke.

Watch the 22-second reconstruction Read the case study

Every finding we publish is anonymised to sector and system type, under written authorization. DATA-01 above came out of an engagement against a multi-tenant AI platform. The same standard applies to your engagement: one label per claim, the raw request attached, and anything we could not close named as a Gap rather than left out.