Record coverage before accepting a clean result

Define what a covered workflow means

List the application areas relevant to the assessment, the roles needed to reach them, and the expected state transitions. A scanner may discover a URL without completing the business action behind it. Distinguish route discovery, a successful authenticated request, an attempted check, and a reviewed result.

For a multi-step approval workflow, opening the final page may require a record created by another role. An ordinary crawl can miss that sequence. The gap should become a specific follow-up question rather than disappearing into a broad claim that the application was scanned.

Explain incomplete work

A useful gap record names the workflow, the missing access or prerequisite, the point of failure, and the next owner. Examples include an account that expired, a route excluded by policy, a tool error, or a state the scanner could not construct. None of those outcomes establishes that the application resisted a relevant attack.

Keep the target build and scan configuration with the result. Otherwise a later reviewer cannot separate the application's behavior from a changed environment or a different account. PortSwigger's DAST explanation discusses practical method limitations; product claims should be read within the configuration actually used.

Make a repair comparison specific

For an accepted finding, retain the effective identity, action, response, and authoritative result. After the deployed change, repeat the relevant action under comparable conditions and check the intended permitted behavior as well as the forbidden behavior.

Suppose a viewer could change a synthetic approval state. A successful retest needs to show that the viewer is now denied while the authorized approver can still perform the intended operation. An expired viewer session would not establish that the authorization rule was repaired.

Review changes in conditions

New test data, account privileges, feature flags, or integrations can alter the outcome independently of the patch. Record the differences. If a comparable test cannot be run, keep that status visible and assign the remaining decision.