As a pen tester, how do you want to engage with a client?

We recently underwent a pen test and some of the results were confusing. We had a MEDIUM vulnerability because our website has port 80 open that redirects to 443. I thought that HSTS with preload wasn't officially supported? I brought this up and they just said "We consider port 80 traffic to be unsecure and thus a vulnerability". Second, they suggested that we are subject to javascript injection because they put a script tag in a field and then, since …

client cybersecurity hsts medium pen pen test port redirects results test thought vulnerability website