> CONFIDENTIAL: This report may contain internal URLs, security vulnerabilities,
> and application details. Do not share outside your organization without review.

# Session Report — [target]

## Session Metadata

| Field | Value |
|---|---|
| Session ID | [session directory, e.g. 2026-09-08-1420-explore-parabank] |
| Kind | explore / quick / mobile / backend |
| Target | [target id or application name] |
| URL | [base URL] |
| Date | [YYYY-MM-DD] |
| Duration | [N] min |
| Charter | charter.md |

## Executive Summary

[Three sentences: what was tested, what was found, and the biggest risk.]

## Summary Stats

| Metric | Count |
|---|---|
| Pages explored | 0 |
| Actions performed | 0 |
| Bugs — Critical | 0 |
| Bugs — High | 0 |
| Bugs — Medium | 0 |
| Bugs — Low | 0 |
| **Total bugs** | **0** |

## Coverage Map

| Area | Risk | Status | Bugs | Notes |
|---|---|---|---|---|
| [Area 1] | P0 | tested | 0 | [notes] |
| [Area 2] | P1 | partial | 0 | [what was not reached and why] |
| [Area 3] | P2 | not-tested | — | [reason] |

_Status: `tested` (fully explored with the planned heuristics) · `partial` (visited, not all heuristics or paths exercised) · `not-tested` (in scope, not reached) · `code-verified-only` (believed correct from reading source, never observed running: this is UNVERIFIABLE, not a pass). Name the single not-tested item that carries the most risk._

## Bugs Found

| # | ID | Title | Severity | Report |
|---|---|---|---|---|
| 1 | BUG-001 | [Component] fails [Condition] causing [Impact] | Critical/High/Medium/Low | bugs/BUG-001.md |

_If no bugs were found, state: "No bugs were found during this session."_

## Observations

_Things noticed that are not bugs but may be worth discussing: what's MISSING against the domain checklist, data-integrity results, questions for the team._

- [Observation 1]
- [ ] [Question 1 — unclear behaviour that needs a human to decide whether it is a bug]

## Areas Not Tested

| Area | Reason |
|---|---|
| [Area 1] | [e.g. blocked by authentication issue] |
| [Area 2] | [e.g. time box expired before reaching this area] |

## Recommendations

- [ ] [Recommendation 1 — e.g. deep-dive into payment-flow edge cases]
- [ ] [Recommendation 2 — e.g. regression-test the login form after the fix for BUG-001]

## Reflection

1. **Biggest risk found:** [one sentence]
2. **What I would tell the CEO:** [one sentence]
3. **What I did not test that still worries me:** [one sentence]
4. **Most useful heuristic / least useful:** [one line]
5. **Next session should focus on:** [one line]

## Session Stats

| Metric | Value |
|---|---|
| Duration | [N] min |
| Phases completed | [N]/8 |
| Bugs found | [N] (Critical: [N], High: [N], Medium: [N], Low: [N]) |
| Pages explored | [N] |
| Screenshots taken | [N] |
| Console errors found | [N] |
| Data integrity checks | [passed]/[total] |