Explain a security report to your client
Start from a completed Scantelio check. Ask your connected assistant to explain the evidence, affected scope and omitted tests. Use the client summary to agree on next steps and the technical evidence to verify the fix.
Prepare a client report walkthrough →One finding, two readers
- Client view: another customer could download a sample contract. Hold document sharing until retest.
- Developer view: tenant B requested tenant A’s fixture attachment. The response returned its private bytes.
- Scope record: 5 November, staging document downloads. Admin exports skipped because no admin fixture was supplied.
Prepare the check with your AI assistant
Sample conversation
Help me turn this staging result into a client decision and a reproducible engineering task.
Assistant · Which completed check should I read? I’ll separate reproduced exposure from missing coverage, then draft a decision for the client and a retest for engineering.
On first setup, verify the target and grant the assistant access to the intended project. Review the draft and confirm the run in your workspace.
Illustrative result and next action
After the fix B received 403 and A could still download the file. Share the PDF summary or JSON evidence from the report with the intended recipient.
Questions before you start
Can I call this a clean audit?
State the date, release and tested routes. An untested export remains open even when the attachment retest passes.
What belongs on the first page?
Lead with the business impact, decision needed and unresolved scope. Keep the reproducible request and fixture details for engineering.
How do I prioritize two findings?
Start with demonstrated exposure of private data and who can trigger it. Keep potential issues identified as requiring confirmation.
Can I send the whole response to the client?
Use redacted evidence. Before forwarding an export, check the recipients and whether it includes target details intended only for engineers.
What can a public URL show?
An external check examines the reachable surface. Private workflows require authorized access and suitable test accounts. A source-code review or expert investigation has a different scope.
Can I reuse a prepared project?
Select the verified project, review the environment and permissions, then confirm the run. Recheck fixtures if the release changed the access model.