Glossary definition

Findings

An audit finding is a documented security or code-quality issue supported by evidence, an impact assessment, and a recommendation or remediation status.

also: audit finding, security finding, audit issue · reviewed July 22, 2026

Findings are the result of the audit process: a detailed record of the auditor’s analysis and tests. Findings can include an assessment of code quality, the quality and clarity of documentation, and specific issues found.

In ack3 audits, issues are divided into the following categories:

Informational issues sit on the boundary between code quality and security. They can become security-relevant if code or configuration changes.
Warning issues cannot be exploited with the audited code or configuration but could become vulnerabilities if the code changes.
Low severity issues are generally comments and recommendations rather than directly exploitable security issues.
Medium severity issues are not immediately exploitable under the reviewed conditions but should be clarified or fixed.
High severity issues are security vulnerabilities that require specific steps or conditions to exploit. They have to be fixed.
Critical severity issues are security threats that can be used to attack the system immediately. They have to be fixed.