## Findings

- **{{Severity}}**: {{module / surface}}: {{description of exposed path or sensitive content}}. Path: `{{/admin/dashboard}}`. Status: {{200 | 401 | 403 | 500}}. Required action: {{specific fix}}.
- {{...}}

## Coverage Notes

- {{paths blocked from probing because base unreachable, or expected-local-only behavior that is safe in this context}}