What you can send back
From The Scope checked the site from outside and found the public trust/security issues that should be fixed first. No login or intrusive testing was performed.
Forward the ranked fix list to your web person or IT contact. If a deeper active audit is required, switch to the Deep Audit with written scope.