recon-scope-triage

Confirm the canonical owned-domain set first, then require concrete ownership signals per asset class: org-owned GitHub accounts for repos, content correlation with confirmed subdomains for buckets, and exact owned-domain matches for breach emails. Never trust a scanner's keyword match alone.

Fetch the reported path (e.g., /.env) and a random junk path on the same host with curl, then compare response sizes and bodies. Identical responses indicate a catch-all route, meaning the finding is a false positive; differing content with expected signatures indicates a real exposure.

ASM tools keyword-match on the brand name across global namespaces like GitHub, S3 bucket names, and app stores. For brands that are common dictionary words, this matches unrelated same-named companies, producing repos, buckets, apps, and breach combos owned by third parties.

Run ownership triage at the very start of the engagement, immediately upon receiving any ASM report, recon export, or OSINT dataset, and before testing anything. Skipping triage risks wasting the engagement on third-party assets and attacking out-of-scope organizations.

Quarantine them explicitly in an auditable file such as loot/quarantined_<source>.txt rather than testing or silently dropping them. This documents that you saw the collisions and chose not to target them, and supports re-baselined severity counts in the final report.