PHASE 01
Read policy and map assets
Know in-scope hosts, exclusions, safe-harbor terms, rate limits, and disclosure rules before sending traffic.
- Separate confirmed assets from guesses.
- Identify roles, money flows, admin paths, and integrations.
The productive loop is policy, mapping, hypotheses, validation, and a report that makes the impact easy to verify.
PHASE 02
Turn recon into tests
Ask who can access an object, what changes state, and what happens if requests are replayed, reordered, or sent with another role.
- Use low-volume, target-specific checks.
- Stop when minimal impact is proven.
PHASE 03
Write for fast reproduction
Give the asset, prerequisites, exact steps, evidence, impact, and a root-cause fix. Do not inflate severity with speculative chains.
- Include a negative control where useful.
- State the tested account, time, and environment.
Frequently asked questions
How do I avoid duplicates?
Focus on new functionality, target-specific workflows, and well-validated edge cases instead of broad noisy scanning.