# External Exposure Assessment — completed rehearsal checklist

**Synthetic worked example — not customer evidence.**

- [x] Reserved example identifiers and loopback-only target.
- [x] Scope failed before authority transfer.
- [x] Authority, target, check, evidence, stop, window, and ROE records present.
- [x] Passive candidate did not become active scope.
- [x] Active phase paused until explicit runbook approval.
- [x] Only exact loopback targets and approved low-impact checks executed.
- [x] Bounded-web allowlist disabled OAST, updates, unsigned templates, intrusive, fuzz, DoS, authentication, credential, and brute-force classes.
- [x] Every synthetic finding links to evidence.
- [x] Report, manifest, hashes, receipt, verifier result, handover, and focused retest exercised.
- [x] Package integrity was not described as proof of system security.