-MANUAL-ONLY BYPASS
No bypass classified
-
What did the scanner miss?
Reconcile automated findings with cross-user probes. A CVE count is not authorization coverage; the boundary is the evidence.
EVIDENCE CSV11 required columns
Use synthetic IDs only. Blank observed_status means the boundary was not executed.
Representative evidence is ready.
Scanner findings and authorization proof are different evidence.
Run the audit to separate known-CVE records, manual boundary outcomes, exposed fields, and missing execution evidence.
Canonical result
Authorization evidence map
Result is useful before download.
0scanner findings
0manual probes
0bypasses
0incomplete
Automated evidence
0 CVE recordsKnown findings imported; authorization coverage is not inferred.
Manual boundary evidence
0 protected / 0 bypassNo exposed fields classified.
Interpretation
A cross-user request that should deny access but returns a 2xx response is classified as a bypass. A scanner finding remains separate evidence; its presence cannot close an untested authorization boundary.
Evidence boundary
This local tool does not scan a live app or prove exploitability, CVE validity, identity, session behavior, business impact, or remediation. Confirm every result in an authorized test environment.