triage-validation

Run the 7-Question Gate in order: confirm a real reproducible HTTP request, check the program's accepted impact list, verify the asset is in scope, rule out unrealistic preconditions, search for known behavior, prove impact beyond 'technically possible', and check the never-submit list. One wrong answer kills the finding.

Never submit missing security headers, SPF/DKIM/DMARC issues, GraphQL introspection alone, self-XSS, logout CSRF, open redirects without a chain, clickjacking without a sensitive-action PoC, or banner disclosure without a working exploit. These destroy your validity ratio.

Re-send the request with a minimal well-formed body instead of a malformed one. A 400 validation error often comes from an input sanitiser running before auth middleware, not from missing authentication. Only a well-formed request reveals where the auth layer actually sits.

Standalone weak findings become reportable when chained to proven impact: open redirect plus OAuth redirect_uri theft yields account takeover, CORS wildcard plus credentialed PII exfiltration is High, and SSRF DNS-only plus internal data access is Medium. Prove the full chain end to end first.

Retract it preemptively with a documented retraction entry covering the original signal, disproving evidence, root cause of the false positive, and date. Self-retraction preserves your reputation signal better than a triager closing it as N/A.