What problem does it solve? Automated recon and ASM tools keyword-match on brand names, so for targets whose name is a common dictionary word, reports are flooded with assets belonging to unrelated same-named organizations. Acting on this untriaged data wastes the engagement on false positives and risks attacking innocent third parties outside the authorized scope. ## Core Features & Use Cases - Ownership Verification Matrix: Per-source verification criteria for GitHub repos, cloud buckets, mobile apps, breach combos, typosquats, and forum hits, anchored to confirmed owned domains. - Soft-404 Detection: A curl-based junk-path control that distinguishes real .env/.git/actuator exposures from SPA catch-all false positives by comparing response bodies. - Severity Re-baselining: Recounts findings against only-owned assets and quarantines collisions into auditable files, surfacing ASM feed quality as a meta-finding. - Use Case: You receive an ASM report claiming hundreds of Criticals for a target named "Apex". Run this triage first to discard unrelated repos, buckets, and apps, then verify each web Critical with the soft-404 control before testing anything. ## Quick Start Triage this ASM report for the target and separate confirmed owned assets from same-name collisions before I start testing.
