Three grades of evidence, and why the labels matter

A security report that treats every finding as equally certain is asking the reader to do the verification themselves. We label every result by the evidence behind it, and we keep hypothesis generation separate from independent verification so the label cannot be inflated by the same system that produced the guess.

Execution-confirmed

The exploit ran inside the sandbox against a reproducible build and produced the predicted effect. Tenant A read tenant B's order. The admin action succeeded without the admin role. This grade always arrives with a patch and a fail-to-pass test, because if we could execute the exploit we can also demonstrate that the fix blocks it.

Independently validated

Sometimes a full exploit is out of scope or out of budget, but a CI or security test derived from your own fixtures demonstrates the flaw. We report that as test evidence and say so plainly. It is strong, it is reproducible in your pipeline, and it is not the same thing as execution.

Unconfirmed hypothesis

A plausible path that could not be reproduced within the agreed budget or scope. We report it for your judgment and never promote it to proof. If a clean replay cannot be verified, nothing moves up a grade. Failing closed is the whole point.

• Patina marks execution-confirmed results, on the site and in the receipt
• Cobalt marks independently validated results
• Unconfirmed hypotheses are rendered faint on purpose