---
name: validation
description: "Run the smallest authorized check that resolves a claim, then retain an evidence-linked outcome even when the result is incomplete."
---

# Evidence-led validation

Run the smallest authorized check that resolves a claim, then retain an evidence-linked outcome even when the result is incomplete.

Defensive study and review of artifacts supplied by their owner. Record missing evidence as an open question.

## Bring to the review

- A bounded hypothesis or security invariant
- Approved account and test conditions
- Evidence location and command or tool version

## Review guide

### 1. Define a decision

Write the expected allowed and denied outcome before testing. Favor owned objects and a minimal action that can decide the claim.

### 2. Record the actual result

When a local Hunt Workbench is available, call record_check with status, command or tool version, limits, outcome, evidence links, and next action. Do not flatten partial, blocked, failed, or not_tested into one result.

### 3. Update the claim

Use upsert_lead only to update the hypothesis and its missing proof. A validated finding requires direct evidence for the stated boundary; unresolved evidence remains a lead.

## MCP calls

Public research on the hosted MCP (generic topics only): `get_research_context`, `search_research`, `get_research_record`.

Durable records in the selected local workspace: `record_check`, `search_hunt_records`, `upsert_lead`.

Keep private evidence and scope records in the local workspace.

## What to produce

- Evidence-linked check record
- Accurate outcome state
- Updated proof gap or validated boundary

## Common mistakes

- Calling a blocked check a negative result
- Overwriting earlier evidence
- Escalating beyond the approved test condition

## Reading and source context

### Resources

- [OWASP Logging: trustworthy and minimal application evidence](https://vulns.co/research/resources/owasp-security-logging-evidence-quality/)
- [OWASP Secure Code Review: baseline and change-focused review](https://vulns.co/research/resources/owasp-secure-code-review-methodology/)

### Diagrams

- [Approval stays attached to the reviewed version](https://vulns.co/research/diagrams/approval-version-integrity/)

### Reports

- [Cloud Build approval was not bound to immutable code](https://vulns.co/research/reports/google-cloud-build-approval-toctou-2025/)
- [GitHub Actions trust depended on invalid repository references](https://vulns.co/research/reports/github-actions-reference-validation-2021/)

## Provenance

Editorial guide by vulns.co / GK Data. Updated 2026-10-12.
Library snapshot: 2026-10-04; commit d5550c7891119cf1379e235721541c947850a3b3.
The guide is an editorial synthesis. Linked records preserve their own sources and review dates.

Reader: https://vulns.co/skills/validation/