§ Proof

Three independent surfaces.

SecHive's public proof is split: a redacted bug bounty corpus showing real-world breadth, full-fidelity Juice Shop reports for reproducibility, and a controlled XBOW-style benchmark campaign in between.

CS.01Runtime authorization replayA signed one-time action that executes more than once. The proof shape is what makes it credible.CVSS High/Critical
CS.02Validation boundary / denylist bypassA policy enforced on one route, skipped on another. Outbound checked, inbound released.Critical impact
CS.03Cross-domain / cross-asset logic abuseAn authorization for object A, rebound to object B through hook or forwarding data.Critical impact
CS.04XBOW-style benchmark campaign104 cases, 99 black-box wins, 104 white-box wins.benchmark
CS.05Bug bounty proof pack90 sanitized results across six method families, HackerOne-shaped.external
CS.06Juice Shop reference reportFull unredacted reproducible benchmark report.benchmark