Before you submit
Skeptic pass. If you cannot kill your own finding, the triager will.
Tags: report, skeptic
Checklist
- In scope?: Host, account type, and vuln class. Recheck the live policy.
- Attacker-controlled?: Did you actually control the source, or did you only find a sink / a public key / a debug page?
- Second user?: IDOR, CSRF, cache, XSS stored: reproduce as a victim account, not just as yourself.
- Confounders?: WAF, cache, your extension, your Hosts file, a staging feature flag, a stale cookie.
- Impact in one sentence: What can an unauthenticated or a low-priv attacker do to someone else?
- Cheaper test: Is there a 30-second check that would falsify this? Do it.
- PoC hygiene: No real malware, no other customers' data, no leftover poison, redacted secrets.
- Duplicates: Search the program's disclosed reports and your own drafts for the same endpoint.