{
  "slug": "validation",
  "name": "Evidence-led validation",
  "category": "Research",
  "summary": "Run the smallest authorized check that resolves a claim, then retain an evidence-linked outcome even when the result is incomplete.",
  "scope": "Defensive study and review of artifacts supplied by their owner. Record missing evidence as an open question.",
  "inputs": [
    "A bounded hypothesis or security invariant",
    "Approved account and test conditions",
    "Evidence location and command or tool version"
  ],
  "review": [
    {
      "title": "Define a decision",
      "body": "Write the expected allowed and denied outcome before testing. Favor owned objects and a minimal action that can decide the claim."
    },
    {
      "title": "Record the actual result",
      "body": "When a local Hunt Workbench is available, call record_check with status, command or tool version, limits, outcome, evidence links, and next action. Do not flatten partial, blocked, failed, or not_tested into one result."
    },
    {
      "title": "Update the claim",
      "body": "Use upsert_lead only to update the hypothesis and its missing proof. A validated finding requires direct evidence for the stated boundary; unresolved evidence remains a lead."
    }
  ],
  "outputs": [
    "Evidence-linked check record",
    "Accurate outcome state",
    "Updated proof gap or validated boundary"
  ],
  "pitfalls": [
    "Calling a blocked check a negative result",
    "Overwriting earlier evidence",
    "Escalating beyond the approved test condition"
  ],
  "mcp": {
    "hosted": [
      "get_research_context",
      "search_research",
      "get_research_record"
    ],
    "workbench": [
      "record_check",
      "search_hunt_records",
      "upsert_lead"
    ]
  },
  "references": {
    "resources": [
      {
        "id": "owasp-security-logging-evidence-quality",
        "title": "OWASP Logging: trustworthy and minimal application evidence",
        "url": "https://vulns.co/research/resources/owasp-security-logging-evidence-quality/"
      },
      {
        "id": "owasp-secure-code-review-methodology",
        "title": "OWASP Secure Code Review: baseline and change-focused review",
        "url": "https://vulns.co/research/resources/owasp-secure-code-review-methodology/"
      }
    ],
    "diagrams": [
      {
        "id": "approval-version-integrity",
        "title": "Approval stays attached to the reviewed version",
        "url": "https://vulns.co/research/diagrams/approval-version-integrity/"
      }
    ],
    "reports": [
      {
        "id": "google-cloud-build-approval-toctou-2025",
        "title": "Cloud Build approval was not bound to immutable code",
        "url": "https://vulns.co/research/reports/google-cloud-build-approval-toctou-2025/"
      },
      {
        "id": "github-actions-reference-validation-2021",
        "title": "GitHub Actions trust depended on invalid repository references",
        "url": "https://vulns.co/research/reports/github-actions-reference-validation-2021/"
      }
    ]
  },
  "provenance": {
    "publisher": "vulns.co / GK Data",
    "guide_updated": "2026-10-12",
    "library_as_of": "2026-10-04",
    "library_commit": "d5550c7891119cf1379e235721541c947850a3b3"
  },
  "url": "https://vulns.co/skills/validation/",
  "markdown_url": "https://vulns.co/skills/validation/SKILL.md"
}