Which of the following is MOST important to include in the final report of a static application-security test that was written with a team of application developers as the intended audience?