## Security Test Evidence

As a convention, in order to being able to group test evidence by component, the component is
the part of the `asset` field prior to the first colon, or the whole string when there is no colon.

For example:

| Asset                     | Component             |
|---------------------------|-----------------------|
| HTTP JSON API service     | HTTP JSON API service |
| OAuth2 middleware: routes | OAuth2 middleware     |