Field notes

Notes on proving a break-in.

Short, practical writing on offensive security: what separates a proof from a guess, the flaws a scanner cannot see, and how we decide what is real.

A scanner’s "critical" is not a break-in

Severity is a guess about what an issue could mean. A break-in is a demonstration that it is real. The gap between them is the whole job.

The flaws that cost the most rarely have a CVE. They are baked into how the app is supposed to work, and nothing about the request looks malicious.

If a finding’s proof does not re-execute from a clean, isolated process, we do not file it. Here is what that standard actually looks like.