QUICKFIX / SAMPLE REPORT
Evidence before the recommendation.
A sanitized example of how QuickFix separates an observation, its meaning and the next thing worth verifying.
| Observation | State | Why it matters | Boundary |
|---|---|---|---|
| Certificate identity | PASS | The public certificate identifies the requested host. | Does not inspect private keys or authenticated paths. |
| DMARC policy | REVIEW | The public record needs a closer look before mail-flow conclusions. | Does not prove inbox placement or sender reputation. |
| Security headers | ACTION NEEDED | A bounded response omitted a selected protective header. | Does not exploit the application or test credentials. |
| Watch volatility | SUPPRESSED | Known measurement noise stayed in evidence and did not become a regression. | Watch scope and cadence are confirmed separately. |
This is a shape-of-report example, not a certification, score or promise of a complete security posture.