Verification · Finding validation
Evidence-backed verification
Re-checks each finding against the code before it is shown: look for counterevidence, require proof, and refute or suppress what does not hold.
Sub-techniques
-
Counterevidence search
V1042.001Look for guards, callers or tests that show the claimed failure cannot happen.
-
Proof requirement
V1042.002Drop findings that cite no line, input or behaviour.
-
Run to confirm
V1042.003Write and run a test or script that demonstrates the failure.
-
Atomic findings
V1042.004Split findings that make more than one claim so each is verified separately.
How to build it
- Run a second, independent pass per finding with the code and the claim only.
- Record a verdict per finding: confirmed, refuted, suppressed or incomplete, with the reason.
- Only post confirmed findings; measure refutation rate per reviewer.
Signals in a repository
- Bot comments that cite evidence, or review tooling that records dismissed findings.