# Findings register (severity-ranked)

Severity: CRITICAL (a consequential action can be executed without authorization, or evidence can be forged) · HIGH (a security property claimed publicly does not hold) · MEDIUM (a material overclaim, or a missing control with a workaround) · LOW · INFO.

| ID | Severity | Title | Claim affected (CLM-…) | Environment | Command / steps | Expected | Observed | Evidence (path + sha256) | Reproduced by someone else? | Status |
|---|---|---|---|---|---|---|---|---|---|---|
| F-001 | | | | | | | | | | |

Rules: one finding per row. Attach raw output, not only a summary. A finding the developer disputes stays open until the evidence settles it.