- Label a static warning by its evidence.
- Document every scanned and missing file.
- Separate attempted action from verified impact.
Start with the claim the tool actually makes
Static tools may flag a suspicious string, trace data to a sink, or classify a finding by evidence level. An OWASP GenAI Project solution listing describes SecureAI-Scan using proven, likely, and heuristic labels. Those labels are part of that tool’s reporting model; the listing is not an independent validation of its accuracy.
Preserve coverage and unknowns
Record scanner revision, enabled checks, every file it saw, unsupported formats, optional remote services, and errors. A clean result from a partial file set is not a complete-package review. The OmniCogg case file illustrates why hidden or omitted file content can change the scope of a scan.
Write a finding in layers
For each finding, preserve artifact and revision; exact observed text or code; the proposed data/action path; what was tested; what the runtime permitted; and any verified effect. Mark missing steps as unknown. A plausible exfiltration path and a verified disclosure are different assertions.
Make the next decision bounded
If evidence is insufficient, hold the exact revision for review. If a test reproduces an unsafe action, address the carrier and enforce the permission boundary. If it is a false alarm, document why and add a regression example. A checked worksheet records a human judgment; it does not perform scanning.
Sources & scope
This guide combines editorial explanation and practical review suggestions. Linked sources support the underlying concepts; this site has not independently replicated their experiments.
S34