---
name: lead-triage
description: "Turn an observation into a ranked, evidence-aware hypothesis with one clear test that could prove or reject it."
---

# Lead triage

Turn an observation into a ranked, evidence-aware hypothesis with one clear test that could prove or reject it.

Defensive study and review of artifacts supplied by their owner. Record missing evidence as an open question.

## Bring to the review

- Observed behavior and stable record references
- Applicable scope and safety limits
- A candidate decisive test

## Review guide

### 1. Name the observation

Record what was directly seen without assigning impact. Link existing assets, checks, timestamps, and evidence references with search_hunt_records.

### 2. State the hypothesis

When a local Hunt Workbench is available, call upsert_lead with supporting observations, possible impact, missing proof, rank, and the next decisive test. A lead is not a validated finding.

### 3. Plan one discriminator

Use record_check to preserve the planned test and its limits. Use next_actions when several gaps compete; it should rank work, not convert a hypothesis into fact.

## MCP calls

Public research on the hosted MCP (generic topics only): `get_research_context`, `search_research`, `get_research_record`.

Durable records in the selected local workspace: `upsert_lead`, `record_check`, `next_actions`, `search_hunt_records`.

Keep private evidence and scope records in the local workspace.

## What to produce

- Ranked lead with stable ID
- Observation and hypothesis kept separate
- One authorized decisive test

## Common mistakes

- Writing impact as observed fact
- Treating a technology fingerprint as proof
- Planning broad retesting instead of a discriminator

## Reading and source context

### Resources

- [OWASP Threat Modeling: system assumptions and mitigation validation](https://vulns.co/research/resources/owasp-threat-modeling-assumptions-and-validation/)
- [Quality Reports](https://vulns.co/research/resources/hackerone-quality-vulnerability-reports/)

### Diagrams

- [Approval stays attached to the reviewed version](https://vulns.co/research/diagrams/approval-version-integrity/)

### Reports

- [Cloud Build approval was not bound to immutable code](https://vulns.co/research/reports/google-cloud-build-approval-toctou-2025/)
- [GitHub Actions trust depended on invalid repository references](https://vulns.co/research/reports/github-actions-reference-validation-2021/)

## Provenance

Editorial guide by vulns.co / GK Data. Updated 2026-10-12.
Library snapshot: 2026-10-04; commit d5550c7891119cf1379e235721541c947850a3b3.
The guide is an editorial synthesis. Linked records preserve their own sources and review dates.

Reader: https://vulns.co/skills/lead-triage/