waf-ips-ids-retest

Use when retesting WAF, IPS, or IDS bypass findings — including Coraza, ModSecurity, or cloud WAFs; multipart grammar differentials (TC-27); HTTP request smuggling (TC-24); parser fail-open detection; response-origin triage; or producing SOC-ready evidence handoff. Provides readiness gates, hypothesis-driven interpretation, and conservative bypass verdicts.