A web scanner labels a reflected parameter as cross-site scripting. What additional evidence best validates the result?

1. The response status is 200
2. The page uses JavaScript for legitimate features
3. The parameter's name contains the word script
4. Execution in the relevant browser context using a safe approved demonstration