CSRF finding on an endpoint that requires a bearer token

You flagged a state-changing endpoint as CSRF-vulnerable, but it only accepts an Authorization: Bearer header, not cookies, so CSRF doesn't apply. Please recheck the auth model.