# Security evidence library

## Answer register
| Buyer question | Control / scope | Answer and limitation | Evidence / date | Owner | Sharing approval |
| --- | --- | --- | --- | --- | --- |
| How are permissions tested? | Named application and build | Describe the performed checks and exclusions | Access matrix and assessment | | |
| How are vulnerabilities handled? | Dependency and incident process | Describe triage, ownership and review dates | Triage record and procedure | | |

## Evidence record
- Document title, version and review date:
- Systems and builds covered:
- Methodology and agreed testing boundaries:
- Findings, remediation and retest references:
- Exclusions and residual uncertainty:
- Distribution classification and authorised recipients:

## Rules of engagement
- Written authorisation and systems in scope:
- Test window and points of contact:
- Permitted techniques and stop conditions:
- Synthetic accounts and protected data:
- Incident escalation and evidence handling:
- Deliverable, remediation discussion and retest scope:

## Finding example — fictional
Observation: a member of organisation A can read a synthetic record belonging to organisation B through one API operation.
Expected: the operation enforces the agreed organisation boundary.
Evidence: record request identifiers and a redacted response in the private issue; do not publish credentials or the exploitable endpoint.
Impact: unauthorised disclosure within the tested operation. The example does not establish the reach of other operations.
Remediation: enforce the object-level policy at the server boundary and add positive and negative regression checks.

## Retest example — fictional
Candidate: demo-43; environment: isolated staging.
Performed: repeat the original refused-access request, test an authorised caller and check the related operation named in the retest scope.
Observed: the original request is denied without object data; the authorised request still succeeds.
Limit: no conclusion about endpoints outside this retest. Attach observed responses and name the reviewer before closing the issue.

An assessment report and an organisation certification answer different questions. Link the exact evidence instead of translating one into the other.