Trust asset
What a reproducible audit finding looks like.
A useful finding is not just a paragraph in a PDF. It gives the team a concrete behavior to reproduce, a reason to care, and a way to verify the fix.
The reproducer fails or demonstrates the issue.
The same evidence verifies the patch or shows what remains.
Structure
Proof findings are built for engineering action.
What the system should do, what it actually does, and which requirement or invariant is affected.
Minimal steps, test case, input, or counterexample that demonstrates the behavior.
Severity, affected surface, blast radius, exploitability, customer impact, and regression likelihood.
Tests, traces, coverage, MC/DC, formal artifacts, or manual review confirmation.
Fix guidance aimed at the bug class, not just the one observed instance.
Patch verification using the same evidence corpus whenever possible.
Why it matters
Reproducibility changes the economics of audit work.
A static finding loses value as the codebase moves. A reproducible finding can become a regression test, release gate, patch-verification artifact, customer evidence, or disclosure-safe case study.