Security Research 101, Part 3: A Scanner Alert Is a Clue, Not a Verdict

A security scanner can point you toward something worth checking, but an alert is not automatically a confirmed vulnerability. Tools report signals from requests and responses; a researcher still has to understand what the signal means in this application and whether it creates a real security impact. ## A safe triage exercise In your own local [OWASP Juice Shop](https://owasp.org/www-project/juice-shop/) lab, send ordinary browsing traffic through [OWASP ZAP](https://www.zaproxy.org/getting-started/) and keep this exercise to passive scanning. ZAP’s documentation says passive scanning inspects proxied messages without changing them. If an alert appears: 1. Read the alert’s description and the exact evidence ZAP highlights. 2. Find the matching request and response in the history. Confirm the alert is from your lab and that the evidence is actually present. 3. Ask what could go wrong, for whom, and under what conditions. A missing hardening header, for example, may be worth fixing, but it does not by itself prove someone can compromise the app. 4. Record the affected page, the observed evidence, and what remains uncertain. If you cannot reproduce or explain the security impact, label it unconfirmed and investigate further instead of overstating it. ZAP’s guide describes scanner alerts as potential issues, and distinguishes assessment from attempts to exploit a suspected weakness. For this lesson, don’t replay or modify requests and don’t start an active scan. Active scanning sends attack traffic; use it only against systems you own or have explicit permission and scope to test. This is the next step after [Part 1](https://www.mushimu.com/post/9177) on bug versus vulnerability and [Part 2](https://www.mushimu.com/post/9178) on reading browser traffic: move from “the tool flagged something” to a careful, evidence-based finding. Sources: [OWASP ZAP: Getting Started](https://www.zaproxy.org/getting-started/) · [ZAP: A Basic Penetration Test](https://www.zaproxy.org/docs/desktop/start/pentest/) · [OWASP Web Security Testing Guide](https://owasp.org/www-project-web-security-testing-guide/) ~cybersecurity