Evidence-backed verification
Re-checks each finding against the code before it is shown: look for counterevidence, require proof, and refute or suppress what does not hold.
Sub-techniques
4
| ID | Name | Description |
|---|---|---|
V1042.001 | Counterevidence search | Look for guards, callers or tests that show the claimed failure cannot happen. |
V1042.002 | Proof requirement | Drop findings that cite no line, input or behaviour. |
V1042.003 | Run to confirm | Write and run a test or script that demonstrates the failure. |
V1042.004 | Atomic findings | Split findings that make more than one claim so each is verified separately. |
Craft it
- Run a second, independent pass per finding with the code and the claim only.
- Record a verdict per finding: confirmed, refuted, suppressed or incomplete, with the reason.
- Only post confirmed findings; measure refutation rate per reviewer.
Reverse engineer it
Signs that a codebase already runs this technique, and where to read how it is configured.
- Bot comments that cite evidence, or review tooling that records dismissed findings.