Highlight the vulnerability with inline comments (using `# <--` or similar) - Show both the malicious request and the unauthorized response - Redact sensitive data in the response (real names, addresses, full card numbers) - Include enough context that the reader understands the attack flow - For co