Before you submit
Skeptic pass. If you cannot kill your own finding, the triager will.
Tags: report, skeptic
Checklist
- In scope? — Host, account type, and vuln class. Recheck the live policy.
- Attacker-controlled? — Did you actually control the source, or did you only find a sink / a public key / a debug page?
- Second user? — IDOR, CSRF, cache, XSS stored: reproduce as a victim account, not just as yourself.
- Confounders? — WAF, cache, your extension, your Hosts file, a staging feature flag, a stale cookie.
- Impact in one sentence — What can an unauthenticated or a low-priv attacker do to someone else?
- Cheaper test — Is there a 30-second check that would falsify this? Do it.
- PoC hygiene — No real malware, no other customers' data, no leftover poison, redacted secrets.
- Duplicates — Search the program's disclosed reports and your own drafts for the same endpoint.