Writing remediation notes engineers will actually pick up

A finding without an owner-ready next step becomes shelfware. Our review template forces every High and Medium item to include a suggested fix shape, not only a vulnerability name.

Prefer verbs over taxonomy

“Broken access control” is a category. “Authorize refund overrides with the same policy used for payment capture, and add a regression test on role X” is a ticket.

Separate proof from lecture

Reproduction notes belong near the top. Threat essays can wait for an appendix. Engineers decide priority from proof and blast radius, not from vocabulary density.

Call out accepted risk explicitly

If a release ships with a Medium open, record who accepted it and until when. Release gates fail when residual risk is only spoken in a hallway.