VULNERABILITY TRIAGE CHECKLIST — FICTIONAL COMPLETED EXAMPLE
All observations below are invented for this exercise. No API or employer system
was tested. The downloadable authorization matrix remains not-run.

FINDING-001 — CROSS-TENANT INVOICE DISCLOSURE
Intake date: 2026-10-17. Source: assumed result of fictional AUTHZ-003.
Related threat: TM-001. Product: fictional invoicing service, example review build.
Affected path: GET /api/tenants/{betaTenantId}/invoices/{alphaInvoiceId}.
Expected: 404, with no Alpha invoice content or metadata.
Assumed symptom: Valid Beta member receives 200 and Alpha invoice content.
Reproduction: Seed separate Alpha/Beta invoices, authenticate as Beta member,
then request the Alpha ID under the Beta tenant path. Do this only in an
owned/authorized test environment and retain the response in private evidence.
Evidence: Hypothetical response only; no actual artifact exists.
Confidence: The symptom is assumed for the exercise; a real case requires validation.

APPLICABILITY AND IMPACT
Reachability: Assume this endpoint is reachable by an authenticated tenant member.
Prerequisites: Valid ordinary member account and another tenant's invoice ID.
Impact: Cross-tenant invoice confidentiality; affected population is not established.
Unknowns: Scope across tenants/versions, identifier exposure, list/search paths,
write paths, exports and whether logs can establish earlier access.
Compensating controls: No independently verified control is credited.
Exploitation: No observation of real-world exploitation is available in this example.
Incident referral: If suspected exploitation is found, invoke the organization's
incident-response process; this worksheet does not establish an incident.
CVE: Not applicable to this fictional finding. CVSS: Not scored in this example.
KEV: Not applicable. EPSS: Not applicable; no published CVE exists here.

DECISION
Disposition: Remediate; give the application owner immediate attention.
Rationale: Assumed confirmed cross-tenant disclosure from an ordinary account;
a high-impact boundary failure merits prompt action despite unknown exploit history.
Owner: Example application team. Decision-maker: example security/product owners.
Immediate action to consider: Restrict the affected path while validating scope,
then enforce verified tenant ownership at the data-access boundary.
Target: Example owners agree 2026-10-18 for remediation review; this is illustrative,
not an SLA. Escalate if scope, impact or exploitation evidence changes.
Status: Open. Acceptance/defer approval: None. Closure date: Empty.
Review trigger: New evidence, missed target date, or another tenant access path affected.

RETEST PLAN — NOT EXECUTED
AUTHZ-003/004: Foreign invoice reads return the example's 404 without disclosure.
AUTHZ-001/002: Own-tenant member/admin reads still return the correct invoice.
AUTHZ-005/006/007: Lists/searches do not leak foreign IDs, counts, fields or aggregates.
Allowed lists must contain their seeded own-tenant rows and expected counts;
only the Beta-only search inside Alpha is expected to return an empty collection.
AUTHZ-013/014: Denied writes do not change the foreign invoice or create side effects.
Inspect related endpoints and exports before defining the final scope of the fix.
Retest evidence/date/reviewer: Not recorded. Residual-risk decision: Still required.

Companion guide: https://www.brandoneckert.com/vulnerability-triage-checklist/