triage-validation

Run the 7-question gate in order: confirm a copy-pasteable HTTP exploit, check the program's accepted impact list, verify the asset is in scope, rule out unrealistic preconditions, search for prior disclosures, prove impact beyond theoretical possibility, and check the never-submit list. One wrong answer means kill the finding.

Never submit missing security headers, SPF/DKIM/DMARC issues, GraphQL introspection alone, version disclosure without a working exploit, self-XSS, logout CSRF, open redirects without a chain, or rate limiting on non-critical forms. These destroy your validity ratio on platforms like HackerOne.

Map your finding to the metric quick guide: network attack vector, low complexity, required privileges, user interaction, scope change, and confidentiality/integrity/availability impact. The skill provides scored examples such as IDOR reading PII at 6.5 Medium and SQLi with full data exfiltration at 9.1 Critical.

These are only conditionally valid with a demonstrated chain. An open redirect becomes Critical when chained to OAuth redirect_uri theft for account takeover; clickjacking needs a sensitive action with a working proof of concept. Submitting them standalone is on the never-submit list.

Retract it preemptively using the retraction template: document the original signal, the disproving evidence, the root cause of the false positive, and the date. Self-retraction preserves your reputation and validation metrics better than letting a triager close it as N/A.