Verification · Finding validation · Evidence-backed verification
Proof requirement
Drop findings that cite no line, input or behaviour.
How to build it
- Reject any finding that does not name a file and line.
- Require each finding to state the input or sequence that triggers the behaviour.
- Drop findings whose claim cannot be tied to code in the diff.
Signals in a repository
- Review tool templates or schemas that require a line reference and a triggering input.
- Bot comments that give a file, line and triggering input for each finding.
In practice
No scanned repository runs a tool for this check. The steps above are the only guidance.