Trust and verification

Finding

One issue raised by verification, with a severity and a mapping to a standard weakness class.

Findings are mapped to the common weakness and OWASP categories so they can be compared across listings and looked up independently.

A summary is public. The full detail goes to the buyer and to subscribers, because complete vulnerability detail on an unfixed issue published to the open internet is a disclosure rather than a review.

Why it matters

It is the unit that makes verification comparable rather than a single word.

The mistake everyone makes

Counting findings. Two low severity advisories in unused code are not worse than one reachable authentication bypass.

Related terms

Verified with findings

A listing that passed verification with issues recorded and published.

RLS

Database rules that decide which rows a given user can see, enforced by the database itself.

SSRF

Persuading a server to make a network request on your behalf, to somewhere you could not reach yourself.

BOLA

When changing an identifier in a request lets you read somebody else's record.

See Finding on a real listing

Every term here shows up in the catalogue next to a real result, with the findings published and the limits stated. Free to browse, no account needed.

Open the catalogue