Vulnerability Diagnose

A suspected vulnerability is not a finding. Before writing anything, build a deterministic reproduction case. If you cannot reproduce it reliably, you cannot report it.

Inspired by the principle: a fast, deterministic, agent-runnable pass/fail signal is a superpower.

Process

Step 1 — State the Hypothesis

Write one sentence: "I believe [vulnerability type] exists at [endpoint/component] because [observed behaviour]."

This is the claim. Everything that follows either confirms or disproves it.

Step 2 — Build the Feedback Loop

Create the minimal test case that produces a binary YES/NO answer:

• An HTTP request that succeeds when it shouldn't
• A payload that executes when it shouldn't
• A response that contains data it shouldn't

The test must be:

• Reproducible — same result every time
• Minimal — only the essential input, no noise
• Unambiguous — pass is clearly different from fail

If you can't build this test case, the hypothesis is not testable yet. Stop and gather more information.

Step 3 — Test Alternate Explanations

Before confirming, rule out:

• Caching (replay the request — is the result fresh?)
• Rate limiting (does it fail on the 5th attempt?)
• Session dependency (does it work with a fresh session?)
• Race conditions (does it fail on a second run?)

Step 4 — Confirm the Impact

Actually demonstrate the worst-case impact:

• For data access: retrieve data belonging to another user
• For XSS: execute alert(document.domain) or exfiltrate a cookie
• For SQLi: extract a row from a table not intended to be accessible
• For privilege escalation: perform an admin action with a user token

A confirmed impact requires evidence (HTTP request + response, screenshot, extracted data).

Step 5 — Document

Produce a Minimal Reproduction Case:

Vulnerability: [type]
Endpoint: [METHOD] [URL]
Precondition: [e.g., logged in as user A]

Request:
[exact HTTP request]

Response:
[relevant snippet proving the issue]

Confirmed impact: [what was demonstrated]
Reproducible: YES / NO (notes if flaky)

Then pass this to finding-writer to produce the full finding.

Rules

• No exploit, no finding — Shannon's rule. If you cannot demonstrate impact, downgrade to "suspected" and label it clearly
• Never report a finding based on tool output alone without manual confirmation
• If the test is flaky (fails intermittently), investigate root cause before reporting
• One hypothesis per session — do not stack unconfirmed vulnerabilities