---
name: handoff
description: "Package local hunt state so another researcher or client can resume from evidence, gaps, and ranked actions without repeating work."
---

# Research handoff

Package local hunt state so another researcher or client can resume from evidence, gaps, and ranked actions without repeating work.

Defensive study and review of artifacts supplied by their owner. Record missing evidence as an open question.

## Bring to the review

- Local workspace with stable records
- Current scope and rules references
- Recent checks, leads, and evidence locations

## Review guide

### 1. Review the state

Use search_hunt_records to confirm scope references, assets, check states, leads, activity, and evidence links. Preserve partial, blocked, failed, and not_tested work as useful history.

### 2. Rank continuation work

When a local Hunt Workbench is available, call next_actions for a short ranked set of gaps and leads. Its rationale may reference public vulns.co research, while workspace evidence remains local.

### 3. Export without overstating

Call export_handoff for a concise Markdown brief. It must cite underlying records and label leads as hypotheses until validated evidence supports a finding.

## MCP calls

Public research on the hosted MCP (generic topics only): `get_research_context`, `search_research`, `get_research_record`.

Durable records in the selected local workspace: `next_actions`, `export_handoff`, `search_hunt_records`.

Keep private evidence and scope records in the local workspace.

## What to produce

- Evidence-linked Markdown handoff
- Coverage and blocker summary
- Ranked next actions with rationale

## Common mistakes

- Hiding incomplete or failed work
- Leaving scope references out of the handoff
- Describing a hypothesis as a confirmed vulnerability

## Reading and source context

### Resources

- [Quality Reports](https://vulns.co/research/resources/hackerone-quality-vulnerability-reports/)
- [OWASP Logging: trustworthy and minimal application evidence](https://vulns.co/research/resources/owasp-security-logging-evidence-quality/)
- [OWASP Secure Code Review: baseline and change-focused review](https://vulns.co/research/resources/owasp-secure-code-review-methodology/)

### Diagrams

- [Approval stays attached to the reviewed version](https://vulns.co/research/diagrams/approval-version-integrity/)

### Reports

- [Cloud Build approval was not bound to immutable code](https://vulns.co/research/reports/google-cloud-build-approval-toctou-2025/)
- [GitHub Actions trust depended on invalid repository references](https://vulns.co/research/reports/github-actions-reference-validation-2021/)

## Provenance

Editorial guide by vulns.co / GK Data. Updated 2026-10-12.
Library snapshot: 2026-10-04; commit d5550c7891119cf1379e235721541c947850a3b3.
The guide is an editorial synthesis. Linked records preserve their own sources and review dates.

Reader: https://vulns.co/skills/handoff/