The acquisition, the board summary and a screenshot full of PII

I would acknowledge the commercial pressure and then decline to change the rating or remove the finding from the executive summary. Severity is a property of the vulnerability and its context, not of the client's acquisition timetable: 1.2 million records with names, addresses and dates of birth is a high-impact breach if exploited, and a WAF is a mitigating control, not a fix. SQL injection through a WAF is a routine bypass, and I have not tested this WAF's ruleset, so I cannot claim the control is effective. I would offer legitimate options instead. Keep the finding Critical but add the client's planned remediation date and a management-response field saying the fix is scheduled in three weeks. Add a note that the WAF provides partial mitigation. Present it in the executive summary as 'one critical finding with a committed fix date' rather than pretending there are none. I would explain that a confirmed critical relabelled Medium is a misrepresentation that could mislead the board and any acquirer, and that both the firm and I carry the contractual and reputational risk. If the client insists, I escalate to my engagement manager and director. The client can accept the risk in writing; I will not relabel it.

The screenshot contains unnecessary personal data in a document that will be circulated, emailed and archived. I would redact it: mask the name, email and policy number, keep enough to show the query returned live records - a row count and the column names are sufficient - and reference the unredacted original held in the evidence store. The report should state that evidence was redacted for data minimization. I would also check the rest of the report and appendices for similar leakage, and consider whether the test itself caused an exposure that the client may need to assess as a notifiable incident under its regulatory obligations. That question should be raised, not buried. On the exploit script, a working exploit in an appendix is a weaponized artefact. I would remove it by default and replace it with a description of the technique and a reference to the vendor advisory, including the script only if the client's technical team explicitly needs it and the distribution list is controlled. The QA reviewer is right, and 'it's only internal' is not a control.

The report contains the confirmed SQL injection with evidence, the affected parameter, the data volumes accessible, the business impact, and remediation (parameterized queries, input validation, WAF tuning as defence in depth), plus the client's management response and committed date. It also contains the redaction note and a coverage and limitations section. If the client insists on Medium and removal from the summary, I would: confirm the instruction in writing, quoting the original finding and the requested change; record that the tester's assessed rating remains Critical and that the client has accepted the risk; escalate internally, because the firm's name goes on the report; and consider whether the request engages a professional code of conduct or a regulatory obligation, particularly for a regulated financial-services client. The report may carry a management-response section where the client states its own view - that is transparency, not misrepresentation. It may not carry a false severity. If the client will not move and the firm will not support me, my option is to decline to sign the report and document why. I would keep the unredacted evidence and all correspondence under the firm's retention policy, because the disagreement may matter later.