visa/visa-vulnerability-agentic-harness

access-control

Find IDOR/BOLA, missing or incorrect authorization, horizontal and vertical privilege escalation, and multi-tenant isolation bypass — the bug is usually an absent check.

batch-etl

Find defects specific to batch and ETL paths: unvalidated bulk input, injection through generated statements, and trust placed in upstream-written data.

client-side

Weaknesses in browser-delivered code — JS/TS, JSX/TSX, Vue, Svelte, Angular, HTML, templates, bundler and Docker config. DOM XSS and code-exec sinks, secrets in bundles or config.js, build-inlined REACT_APP_/NEXT_PUBLIC_/VITE_ env, source maps and dev servers…

code-exploration

Exhaustive repository exploration procedure — Glob the whole tree into a written inventory, group it by directory, and account for every file including templates, Dockerfiles, compose and k8s manifests, nginx/uwsgi/gunicorn config, CI workflows, dotfiles, SQL…

crypto

Find broken or misused cryptography: weak hashes and ciphers, unsalted password storage, predictable randomness, bad key or IV handling, disabled certificate verification.

csrf

Find state-changing requests that a third-party origin can forge: missing or unverified CSRF tokens, unsafe SameSite, and CORS that trusts a reflected Origin with credentials.

deserialization

Find unsafe deserialization of untrusted data: pickle, yaml.load, native object streams, and type-confusable decoders that instantiate attacker-chosen classes.

hardcoded-creds

Find credentials, keys, tokens and signing secrets committed in source, config, manifests or deployment files.

iac

Find infrastructure-as-code and deployment misconfiguration in Terraform, Dockerfiles, Kubernetes/Helm, compose, CloudFormation, Ansible, and CI pipelines: over-permissive IAM, exposed services, container escape, secrets in manifests, unpinned supply chain,…

injection

Hunt injection classes (SQL, NoSQL, OS command, LDAP, XPath, XXE, CRLF, SSTI, open redirect, path traversal, SSRF, server-emitted XSS, ReDoS) under a source/sink/no-defence hard gate. Ships probe.sh: a per-class sink sweep plus a census of the defences…

log-injection

Find unsanitised input reaching log sinks: forged log records, injected control characters, and sensitive values written to logs.

logic-bug

Find business-logic defects: missing validation on amounts and quantities, race conditions and TOCTOU, workflow steps that can be skipped or replayed.

missing-controls

Find weaknesses that consist of an ABSENT control — no rate limit, no session invalidation, no cookie flags, debug left on, secrets or PII stored in cleartext — by enumerating every site the control belongs and checking each.

sensitive-data

Find sensitive data reaching somewhere it should not: PII, credentials or internals in HTTP responses, logs, error pages, templates, caches, headers, debug routes, or stored unprotected. Point-of-occurrence — no injection path required. Ships probe.sh, which…

sibling-instances

After confirming a weakness, sweep the repository for every other site of the same pattern and report each one — a class confirmed at one location is almost never present at only one location.

ssrf

Hunt Server-Side Request Forgery (CWE-918) — any outbound fetch whose URL, scheme, host or port derives from a request. Activate on avatar-by-URL, webhook/callback registration, URL preview/unfurl, render-to-PDF/screenshot/thumbnailer, import-from-URL, feed…

templates

View-layer lens: stored and reflected XSS in server-rendered templates of every dialect (Jinja2 |safe / autoescape false / safe_columns, Django mark_safe, Handlebars {{{ }}}, ERB raw / html_safe, Thymeleaf th:utext, JSP <%= %>, Vue v-html, React…

validation-scoring

Apply the s11 fix-validation scoring matrix, adversarial-review rules, and structured-output contract when validating remediated findings.