hunt-triage-validation

# Triage & Validation ## The 7-Question Gate (applied to EVERY finding) First NO = KILL. Do not continue. 1. **Q1**: Exact HTTP request + response showing the issue RIGHT NOW? 2. **Q2**: Bug class accepted by this program? 3. **Q3**: Asset in-scope, owned by target (not third-party)? 4. **Q4**: Works without admin/privileged access? 5. **Q5**: Not documented behavior or known issue? 6. **Q6**: Impact proved with actual data (not just status code)? 7. **Q7**: Not on the never-submit list? ## Never-Submit List Missing headers (CSP/HSTS/X-Frame-Options), missing SPF/DKIM/DMARC, GraphQL introspection alone, banner/version without exploit, clickjacking without PoC, self-XSS, open redirect alone, SSRF DNS-only, CORS wildcard without credentialed exfil, logout CSRF, rate limit on non-critical, missing cookie flags alone, OAuth client_id alone, OIDC discovery endpoints, SPA client-side config. ## 4 Pre-Submission Gates **Gate 0 (30 sec)**: Confirmed with real HTTP? In scope? Reproducible? Evidence? **Gate 1 (2 min)**: What does attacker walk away with? Real victim? Max 2 preconditions? **Gate 2 (5 min)**: Searched hacktivity? Read disclosed reports? Not in changelog? **Gate 3 (10 min)**: Title follows formula? Steps have exact HTTP? CVSS calculated? ## Conditional Validity (chain required) | Finding | Chain Needed | Without Chain | |---|---|---| | Open redirect | + OAuth code theft → ATO | KILL | | SSRF DNS-only | + internal data exfil | KILL | | CORS wildcard | + credentialed data theft | KILL | | GraphQL introspection | + auth bypass on mutations | KILL | | S3 listing | + secrets in bundles | KILL | | Prompt injection | + IDOR via chatbot | KILL | ## Severity Calibration | Impact | Severity | |---|---| | Full ATO, RCE, mass PII exfil | Critical | | Read/modify other user's private data | High | | Stored XSS in victim context | Medium-High | | Info disclosure (sensitive creds) | Medium | | Info disclosure (non-sensitive) | Low/Info |