Findings and statuses

What a finding contains

Every finding has the same fields, and a test fails if any rule leaves one out:

Field	Example
Rule id	pii.logged
File and line	api/users.ts:42
Status	gap
Severity	high, medium or low
Title	Personal data written to logs
Controls	GDPR Art. 32 · SOC 2 CC6.1 · ISO 27001 A.8.11
Fix	Mask or remove the personal field before logging.
Auditor note	Why it matters, in plain words.

One finding lists every control it touches across the frameworks you chose, so one fix can close several gaps.

The four statuses

Status	Meaning	What to do
Gap	A rule found code that breaks a control.	Fix it. The finding says how.
Partial	A rule found a likely problem that depends on context, for example a CORS setting that is fine for a public read-only API.	Read the note, confirm, then fix or accept it.
Met	The rule for this control ran on your code and found nothing.	Nothing. It’s listed in the report so you can show it.
Outside code	The control needs a document or record, not code, such as access reviews or training.	Collect the evidence named in the report.

What Met does and doesn’t mean

Met means: the rules Lintsure has for this control found no problem in the files it read. It doesn’t mean the control is fully met in every sense an auditor would check, and it doesn’t cover code Lintsure skipped. Lintsure is a readiness tool, not an audit or legal advice.

Severity

Each rule has a fixed severity. High means likely real harm or a likely audit finding, like a committed secret. Medium usually means it depends on context. Severity doesn’t change from run to run.