Why is this Finding on my Pentest Report?

This blog explains why consultants include seemingly minor or best-practice findings in web application assessment reports—even when no critical issues are found—illustrating with examples (e.g., missing security headers, verbose errors, outdated libraries, open directories, session cookie flags, and weak TLS) and discussing remediation challenges and report customization options.