Anatomy of a finding.

Autonomy without proof is just noise. Every Kleydin finding is something you can check, re-run and defend to a client.

One finding, knotted to its proof. Scroll to tighten it.

Six parts, one finding.

A finding is not a sentence in a report. It is a claim with the proof attached, from entry point to verdict.

1
The claim
One sentence, with the verdict attached. No severity theater, no unexplained score.
Auth token stored unencrypted in SharedPreferences
Confirmed

The exact routine, as it was recovered from the binary, not a pattern match on a file name.

// com/acme/bank/auth/AuthStore.java (decompiled) · KLY-0139
void save(String token) {
  prefs.edit().putString("auth_token", token).apply();
}

3
Call path
Every hop from the entry point to the sink, so a reviewer can see how the code is reached.
LoginActivity.onLogin()AuthStore.save()SharedPreferences
4
Re-runnable check
A check that reproduces the finding on the same binary, so anyone can run it again and get the same answer.
check · KLY-0139 · acme-bank-4.2.apk
5
Dynamic confirmation
Where a device or emulator can run the app, the behavior is observed, not inferred.
Device
Pixel 6 · Android 14
Observed
/data/.../shared_prefs/auth.xml
Token
plaintext, readable after backup
6
Verdict: Confirmed
Only once the check reproduces and the Disprover fails to break it does the finding reach your report.
Confirmed KLY-0139
Reproduced statically and dynamically. Report it as fact.

Reproduced with a re-runnable check or confirmed dynamically on a device. Report it as fact.

Strong static evidence (decompiled code and a call path), but not yet dynamically confirmed.

Flagged for a human to take further. Never reported as fact and never counted as a finding.

One agent whose only job is to prove the others wrong. It runs before anything reaches you.

It looks for an alternate explanation for the evidence
It checks whether the code is dead or actually reachable
It checks the environment conditions the claim depends on
Refuted findings are dropped and logged, so you can see what was thrown out and why

What survives keeps its label. What fails never reaches your report.

Fictional example. The target (Acme), findings and IDs are invented to show the report format.

A fictional banking-app teardown showing exactly how findings, evidence and verdicts are laid out.