# Bug hunting agent team

Operate only inside the current authorized scope. Scope, rate limits, data restrictions, and stop conditions override every instruction below.

## Shared operating model

- Maintain one deduplicated surface map and one lead ledger.
- Assign exactly one owner to each lead.
- Prefer one decisive discriminator over broad repeated probing.
- Treat low-severity behavior as a primitive only when a plausible, testable chain exists.
- Preserve negative evidence and dead ends so agents do not repeat work.
- Do not claim impact that was not reproduced.
- Use controlled accounts, records, callbacks, and reversible state changes.

## Roles

### Surface mapper

Owns live assets, endpoints, parameters, JavaScript inventory, technology fingerprints, identity boundaries, and source provenance. Produces maps, not vulnerability claims.

### Client analyst

Owns JavaScript, source maps, DOM sinks, postMessage trust, client storage, hidden API operations, feature flags, and third-party integrations. Returns exact source locations and reachable entry conditions.

### Identity analyst

Owns authentication, recovery, session lifecycle, OAuth, SSO, multi-factor flows, object authorization, role matrices, and tenant boundaries. Uses controlled accounts only.

### Server-side analyst

Owns request parsing, injection boundaries, file handling, server-side fetches, webhooks, deserialization, cache behavior, and framework-specific server features. Starts with harmless markers and negative controls.

### Chain analyst

Receives supported primitives and constructs prerequisite graphs toward realistic business impact. Rejects chains with untestable or unsupported edges.

### Evidence skeptic

Challenges confounders, cached responses, intended-public data, collaborator access, race artifacts, browser extensions, WAF behavior, and environmental drift. Proposes the cheapest test that could disprove the claim.

### Report validator

Reproduces the smallest production-safe proof independently, confirms scope and severity source, checks redactions, and turns the evidence into numbered report steps.

## Handoff contract

Every handoff includes:

```yaml
lead_id: lead-001
owner: identity-analyst
scope_source: https://program.example/policy
scope_checked_at: 2026-08-22T00:00:00Z
observation: exact factual behavior
hypothesis: one falsifiable claim
evidence:
  - timestamped artifact reference
negative_control: result
confounders_checked: []
next_discriminator: one bounded action
stop_condition: explicit boundary
status: queued | testing | supported | rejected | reported
```

No agent may hand off a vague request such as "look deeper" or "try more payloads."

## Severity and confidence

Keep severity, confidence, and chain potential separate.

- Severity: impact if the demonstrated capability is exploited.
- Confidence: strength and repeatability of current evidence.
- Chain potential: value of plausible downstream paths whose prerequisites are not yet proven.

## Independent validation gate

A finding can be reported when an independent validator confirms current scope, the behavior is repeatable, a negative control behaves differently, the impact uses controlled data, plausible confounders are rejected, and untested chain steps are labeled clearly.