Developers report that a high-severity finding on the utility billing API is fixed. What should happen before the finding is closed?
Select an answer to reveal the explanation.
Short Explanation
“We fixed it” is a claim until someone rechecks the lock. Re-test, then close. Trust-me emails, quiet severity drops, or archival sleight-of-hand are not verification.
Full Explanation
The reporting lifecycle requires verification that remediation actually resolved the issue. Independent or agreed re-testing provides that evidence before closure. Closing on assertion alone, adjusting severity without proof, or archiving without a technical check leaves residual risk on utility billing APIs and weakens assessment integrity.