A finding without a path to reproduce becomes a debate. We write steps that an engineer can follow in a staging environment using the same branch tags referenced in the engagement letter.
Screenshots help stakeholders skim severity, but the durable artefact is the request sequence, the affected route, and the condition that makes the issue appear.
When a fix lands, that same evidence becomes the checklist for a remediation verification pass. Closed means closed under the original steps — not merely that a related file changed.
Ask your auditor how they capture evidence before the engagement starts. Aligning on staging access early prevents last-week scrambling.