## Findings

- **{{Severity}}** ({{WSTG-ATHN-03}}): {{module}} / {{area: jwt | session | token-storage | brute-force | password-policy | oauth}}: {{one-paragraph defect description}}. Evidence: `{{file}}:{{line}}`. Required action: {{specific fix}}.
- **{{Severity}}** ({{WSTG-SESS-10}}): ...

## Open Questions

- {{omit when none}}