Detection Is Not Proof: How to Verify a Bug Before You Report It

A scanner says 'possible XSS.' That's a guess, not a finding. Here's the three-question test every bug should survive before you submit it — plus a time-based SQLi example you can prove with a stopwatch.