Chapter 1
What Vybentis can prove
- 01
Trace the deterministic rule
Open the finding and identify its documented rule identifier. The supported statement must come from that rule, not from a language model judgment or a broad score.
- 02
Read evidence, confidence and scope
Read what was observed, how confidently the rule matched and which target, mode and time the observation covers. Keep all three attached to the conclusion.
- 03
Repeat the matching verifier
After a change, run the verifier that can observe the same condition again. A repeatable threshold supports a resolved state for that rule.
Check before continuing
- Evidence based checks
- Clear scope and confidence
- Repeatable verification
Chapter 2
What it cannot prove
- 01
Separate a rule from the whole product
A passed or resolved rule supports only its documented condition. Do not generalize it to every route, role, service or future release.
- 02
Identify hidden and unauthenticated gaps
Mark private services, database policies, authenticated roles, historical secrets and unobserved business logic as unknown unless separate evidence covers them.
- 03
Reject unsupported claims
Do not present a report as a penetration test, legal compliance certificate, guarantee of security or proof that no vulnerabilities exist.
Check before continuing
- No active exploitation
- No vulnerability free guarantee
- No legal certification
Chapter 3
Add qualified review
- 01
Identify manual review candidates
Escalate authentication, authorization, sensitive data flows, payment logic, webhooks, destructive scenarios and changes with material business or safety impact.
- 02
Give the reviewer a bounded brief
Provide architecture context, intended behavior, user roles, data sensitivity, release changes and the Vybentis evidence. Exclude credentials and raw secrets.
- 03
Record an independent decision
Keep the reviewer, date, scope, methods and remaining limitations with the release decision. Do not merge manual conclusions into automated rule results.
Check before continuing
- Threat and architecture review
- Manual business logic testing
- Independent review before high impact release