Module 5 · Responding, and getting hired Lesson 14 of 15
Writing a finding like a professional
A security finding a client will pay for has five parts: title, risk, evidence, impact and fix - in that order, in plain language, with the retest. No drama, no blame.
The concept
Write for a busy non-security reader: the fix and the impact first, the technical detail in an appendix. A finding nobody acts on has protected nothing.
Always include a retest step - "verify by loading /admin in a private window" - so the client can confirm the fix themselves, which is what closes the ticket.
Title: Admin page reachable without authentication
Risk: High
Evidence: GET /admin returns 200 and user data with no session cookie
Impact: Anyone can read every user record
Fix: enforce the role check on the server for the route, not the menu
Retest: load /admin in a private window -> expect 403
Detail (appendix): the request, the response headers, the timestamp.Worked example
Title: "Admin page reachable without login". Risk: High. Evidence: the request and response. Impact: full data access. Fix: enforce the role check server-side.
Your practice task
Turn one issue you found in a lab into a one-page finding in the five-part format.
Do this before moving on. Reading a solution teaches the shape of it; typing it teaches you.
Key takeaway
Write for a busy non-security reader: the fix and the impact first, the technical detail in an appendix.
Keep your place in this course
A free account saves which lessons you have finished and unlocks the certificate. The lesson itself stays free to read.
Create free account or sign inCourse complete
You finished every lesson.
Your certificate is ready, and the projects you built are the proof to attach to an application.
Almost there
15 lessons left of 15
Finish every lesson to unlock the certificate. Each one ends in a practice task — do them and the final project brief writes itself.