EVYCOMPANY

AEGIS / THE EVIDENCE DESK

A finding is a question.
The evidence is your next step.

Learn to read a static website security report: what was reviewed, which build was observed and what still needs a decision.

Try the report reader ↓Download the checklist ↗

Free educational resource. No account, website scan or email required.

Three labels that change the meaning.

01 / READ THE SOURCE OF A CONCLUSION

A

Baseline observation

A finding observed in the original supplied build. It describes that version, even when a later report retains the observation for context.

Illustrative example: a literal HTTP resource

ILLUSTRATIVE, not customer evidence. The original HTML references a resource using HTTP. The observation needs a file, location and reviewed-build manifest; the text alone does not prove current exposure.

B

Retested file correction

The changed file was checked again, under the same declared check family. Read the retest evidence and its current manifest before relying on the result.

What “fixed and retested” supports

It supports the bounded check on the retested files. It does not establish that the files were deployed or that the running website has no vulnerabilities.

C

Owner action unverified

Some actions happen outside the supplied files: rotating a credential, changing a server setting or deploying a build. A static retest cannot verify those actions.

What evidence is still needed

Ask the owner for an appropriate verification under a separately agreed scope. A removed credential-shaped string is not proof that the credential was revoked.

Can this report support your next decision?

02 / LOCAL LEARNING EXERCISE

Choose a scenario. These choices stay in this page; nothing is assessed or submitted. The result explains evidence sufficiency, not whether a website is secure.

Select a scenario to inspect its limits.

Take the questions into your next review.

03 / FREE REPORT CHECKLIST

  1. Confirm the owner, authorized assets, permitted methods and exclusions.
  2. Match the report asset manifest to the exact build you intend to deploy.
  3. Separate baseline observations from observations made during the retest.
  4. Read each finding with its evidence, scope, priority and limitations.
  5. Distinguish file changes retested from owner actions that remain unverified.
  6. Treat an open or newly observed finding as unresolved until separately reviewed.
  7. After any build change, obtain a retest of that build before reusing a conclusion.
  8. Keep the approved change, rollback route, report and remaining risks together.
Download the checklist (JSON) ↗

No personal data or scenario choices are included in this download.

An assessment starts with a written scope.

AEGIS reviews bounded owner-supplied static website builds, records evidence, applies separately approved file corrections and retests the changed build.

It does not offer live vulnerability scanning, server-side review, authentication testing, dependency auditing or a security certification. Schedule and cost are agreed in a written proposal.

Prepare an assessment enquiry ↗

For public-source guidance on testing coverage, see the OWASP Web Security Testing Guide. Its broader coverage is not a claim about the service offered here.