Validation sits between hunt and report. Weak findings waste triage time and hurt reputation scores. Run validation before writing a submission.

​
CLI

triage is the fast pass/kill/downgrade path. Pipe a finding via stdin when the argument is omitted (validate supports this). MCP equivalents: bughunter_validate, bughunter_get_validation (see MCP).

​
7-Question Gate

From the triage-validation skill / FAQ checklist:
  1. Can an attacker do this right now, with a real request?
  2. Does the attacker need special access most people do not have?
  3. Is there actual impact (data leak, account takeover, money loss, code execution)?
  4. Has this already been reported or disclosed?
  5. Is the vulnerability in scope for this program?
  6. Is there a clear reproduction step?
  7. Is the severity accurate?
One wrong answer → kill or downgrade. Do not spend time on a report until the gate passes.

​
Rules of thumb

  • Theoretical bugs (“could potentially…”) are not reportable — prove live impact
  • Conditionally valid issues often need a chain (bughunter chain) before they pay
  • Prefer [CONFIRMED] / [POSSIBLE] / [INFORMATIONAL] confidence language used by the scanners
  • Use the triage-validation and report-writing skills before platform submit

​
After validation

Reports are drafts for HackerOne, Bugcrowd, Intigriti, or Immunefi formatting. Nothing is auto-submitted.