Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
Create from the IDOR matrix
Open Advanced → Findings and save the confirmed insecure resource result. Include endpoint, policy, attacker and owner, two object IDs, statuses, response hashes, and sanitized bodies.
Set severity and confidence
Use severity for impact and confidence for evidence strength. Two foreign objects with sensitive data justify higher confidence than one status-only difference.
Consolidate duplicates
Run the same object once more. Confirm WSHawk links or merges the duplicate instead of creating a competing finding with different evidence.
Use lifecycle states
Keep new evidence Open, mark reproduced evidence Confirmed, use Rejected for false positives, Fixed only after a successful retest, and Inconclusive when auth or cleanup prevents a conclusion.
Prove it before moving on.
One confirmed finding contains both object confirmations and no redundant duplicate remains open.