Vulnerability Scan False Positives: How to Triage One

Recognise a false alarm in a security finding, check the evidence in a fixed order, and record a dismissal someone can audit later.