diff --git a/devdocs/modernization/SECURITY-REVIEW.md b/devdocs/modernization/SECURITY-REVIEW.md
index 113fecd3..077fd66f 100644
--- a/devdocs/modernization/SECURITY-REVIEW.md
+++ b/devdocs/modernization/SECURITY-REVIEW.md
@@ -184,6 +184,9 @@ customer reaching another's data; or serious abuse of the company's resources) 
 Status: *candidate* (seen in code, not yet confirmed), *confirmed*, *fixed in case NNNN*,
 *accepted*.
 
+**Finding IDs are permanent:** never renumber or reuse them; John's cases refer to them. New findings
+take the next free number; a fixed or accepted finding keeps its ID and changes status.
+
 | ID | Severity | Status | Title |
 |---|---|---|---|
 | F41 | **Critical** | confirmed (code) | F5 also in Sockeye (internet-facing admin login) and in the 8.2.x business AyaNova server |