What a pentest closure record should contain for auditors and customers

A pentest report lists vulnerabilities, but auditors and enterprise customers want a record showing what was fixed, what changed, and proof the fix worked. The article proposes six fields per finding: a stable ID and weakness with location, scope agreement, the change and its rationale, who authored and reviewed it, a rescan confirming the fix, and the merge date. It illustrates this with a rehearsal Fix Sprint on the deliberately vulnerable OWASP NodeGoat app, where 15 of 16 in-scope findings were fixed across five pull requests. One finding, a committed TLS private key, was explained rather than changed, since deleting the file would not remove it from git history. The article also warns against closing findings by deleting evidence, merging without rescanning, and bundling many fixes into one pull request.