ROB VIPER / ANALYSIS CASE
Case ID and classification:
Question and authorized scope:
Reporter / operator / analyst / incident or application owner:
Artifact source, collection time and timezone:
Original and analysis-copy SHA-256; evidence-storage reference:
Engine version and SHA-256; database details; reviewed rule SHA-256:
Scan kind, target, start/finish, outcome and scanner exit:
Findings (exact evidence; separate observations from interpretations):
Coverage, skipped targets, truncation and missing evidence:
Was this artifact executed? Evidence for that answer:
Alternative explanations and false-positive review:
Priority rationale; business exposure; affected configuration:
Decision, approver and timestamp:
Remediation owner, due date, rollback and validation plan:
Deployed version/hash; same-scope rescan; application regression evidence:
Residual risk, exception expiry, retention and closure reviewer:

CVEs additionally require package ecosystem/name/version, dependency path,
inventory evidence, advisory URL, fixed version, CVSS source, dated KEV/EPSS
context where useful, and proof the changed dependency reached deployment.
Never put recovery keys, credentials or complete private samples in a ticket.
