## Findings

- **{{Severity}}** ({{WSTG-AUTHZ-04}}): {{module}} / {{area: idor | privilege-escalation | tenant-isolation | hidden-admin | impersonation | broad-export}}: {{defect}}. Evidence: `{{file}}:{{line}}` or `{{doc.md}}`. Missing proof: {{which test/policy/doc would resolve this}}. Required action: {{specific fix}}.
- {{...}}

## Open Questions

- {{omit when none}}