Evidence

A finding is only as good as the artifact behind it

Most audit tools tell you what they concluded. Obcend shows you what it saw. Every record below is stored, hashed, and retrievable for the lifetime of the audit.

Anatomy

One finding, fully expanded

This is the actual shape of an evidence record — not a marketing illustration of one.

OBC-SEC-0114

No Content-Security-Policy header on authenticated document responses

Artifact hash: sha256:4f1c…a2be
Ruleset version: ruleset 2026.07.1

https://example.com/account/settings — response headers

<!doctype html>
<html lang="en">
  <head>
    <meta charset="utf-8" />
    <meta name="viewport" content="width=device-width" />
    <!-- no <meta http-equiv="Content-Security-Policy"> present -->
    <title>Account settings</title>
  </head>

Schema

Fields present on every record

No record is emitted with a missing field. If evidence could not be captured, the observation is discarded rather than reported.

Evidence record fields, their meaning, and example values
Field	Meaning	Example
rule_id	Stable identifier for the rule that matched	OBC-SEC-0114
ruleset_version	The exact published ruleset the run executed	2026.07.1
observed	The value actually present in the captured artifact	header absent
expected	The value the rule requires, stated before the run	non-permissive CSP
source	URL plus element path or header name	/account/settings › headers
artifact_hash	SHA-256 of the stored response, immutable after capture	sha256:4f1c…a2be
reproduction	Executable steps that re-derive the finding	curl -sI … && assert
agreement	How many independent runs produced the same result	3 of 3

Fieldrule_id
MeaningStable identifier for the rule that matched
ExampleOBC-SEC-0114
Fieldruleset_version
MeaningThe exact published ruleset the run executed
Example2026.07.1
Fieldobserved
MeaningThe value actually present in the captured artifact
Exampleheader absent
Fieldexpected
MeaningThe value the rule requires, stated before the run
Examplenon-permissive CSP
Fieldsource
MeaningURL plus element path or header name
Example/account/settings › headers
Fieldartifact_hash
MeaningSHA-256 of the stored response, immutable after capture
Examplesha256:4f1c…a2be
Fieldreproduction
MeaningExecutable steps that re-derive the finding
Examplecurl -sI … && assert
Fieldagreement
MeaningHow many independent runs produced the same result
Example3 of 3

Consequence

What this changes in practice

Disputes end quickly

When an engineer says "that isn't happening on our side," you open the captured response with its timestamp and hash. There is nothing left to debate.

Tickets write themselves

Observed, expected, and location are exactly the three things a ticket needs. No triage call is required to turn a finding into work.

Progress is verifiable

Re-run at the same ruleset version and the delta is real. Score movement is never an artifact of the tool changing its mind.

See a deterministic audit of your own site

We run a scoped crawl, produce evidence-backed findings, and walk your team through the report. No obligation, no pipeline pressure.

Request a demo Read the methodology