---
name: recon-review
description: "Normalize saved recon into a provenance-preserving local inventory, then use it to expose coverage gaps without expanding authorization."
---

# Recon review and normalization

Normalize saved recon into a provenance-preserving local inventory, then use it to expose coverage gaps without expanding authorization.

Defensive study and review of artifacts supplied by their owner. Record missing evidence as an open question.

## Bring to the review

- Saved URL lists, JSONL, CSV, or HAR files
- Tool and collection timestamps
- Recorded scope and rules

## Review guide

### 1. Import rather than paste

When a local Hunt Workbench is available, call import_recon for each saved artifact. Preserve its source, timestamp, and observed technology fingerprints; repeated imports should remain idempotent.

### 2. Review normalized inventory

Use search_hunt_records to find assets, routes, technologies, and prior activity. Keep observed hosts distinct from authorized targets.

### 3. Record coverage honestly

Use record_check for what was reviewed and its state. Keep not_tested, partial, blocked, failed, deferred, and out_of_scope distinct so gaps remain visible.

## MCP calls

Public research on the hosted MCP (generic topics only): `get_research_context`, `search_research`, `get_research_record`.

Durable records in the selected local workspace: `import_recon`, `search_hunt_records`, `record_check`.

Keep private evidence and scope records in the local workspace.

## What to produce

- Deduplicated asset inventory with provenance
- Technology and route observations
- Coverage record with explicit gaps

## Common mistakes

- Discarding source or timestamp during normalization
- Treating a discovered asset as in scope
- Calling a partial crawl complete coverage

## Reading and source context

### Resources

- [OWASP Secure Code Review: baseline and change-focused review](https://vulns.co/research/resources/owasp-secure-code-review-methodology/)
- [OWASP Logging: trustworthy and minimal application evidence](https://vulns.co/research/resources/owasp-security-logging-evidence-quality/)

### Diagrams

- [Layer server-request destination controls](https://vulns.co/research/diagrams/server-request-destination-policy/)

### Reports

- [Shopify Exchange screenshot service crossed internal boundaries](https://vulns.co/research/reports/shopify-exchange-request-isolation-2019/)

## Provenance

Editorial guide by vulns.co / GK Data. Updated 2026-10-12.
Library snapshot: 2026-10-04; commit d5550c7891119cf1379e235721541c947850a3b3.
The guide is an editorial synthesis. Linked records preserve their own sources and review dates.

Reader: https://vulns.co/skills/recon-review/