A client asks which of two findings to fix first: a minor internal banner leak or an externally reachable authentication bypass on a sensitive application. What is the strongest prioritization basis?

1. The size of screenshots in the report
2. Validated exploitability, exposure, and business impact
3. The alphabetical order of the finding names
4. The tester's preferred programming language