A tester has one low-impact finding and an unvalidated hypothesis for a more serious chain. How should the report distinguish them?

1. Assign the same confidence automatically to every claim
2. Describe confirmed evidence separately from the proposed but untested chain
3. Present the whole chain as confirmed to encourage remediation
4. Omit all assumptions and limitations