Proof / Bug bounty proof pack
A disciplined path from candidate to report.
This page documents the six method families used to organize research and the proof standard applied before a candidate can become a report. Internal workflow items are not presented as confirmed vulnerabilities, public CVEs, or vendor-accepted findings.
Six families, one proof shape.
Each family is documented with a top-find write-up that preserves vulnerability logic and review value while removing target identifiers.
- M.01Business logic / runtime validationReplay, duplicate execution, stale authorization, payment state mismatch.Featured →
- M.02Source-first policy reviewDenylist gaps, finality downgrade, controller revocation, unsafe validation boundary.Featured →
- M.03Cross-domain protocol reasoningAsset rebind, forwarding mismatch, bridge / cross-chain state inconsistency.Featured →
- M.04Auth and identityStep-up bypass, callback / token leakage, login-state confusion.in inventory
- M.05Mobile and exported interfacesBroadcast injection, exported providers, binder / interface exposure.in inventory
- M.06Cloud and configurationSecret exposure, public debug / RPC surfaces, static management dumps.in inventory
Public-safety boundary
The coordinated-disclosure pages present only public-safe mechanisms, proof standards and remediation patterns. They intentionally remove target names, domains, report IDs, package identifiers, secrets, hashes, private correspondence, and reusable production exploit steps. Generalized patterns are methodology examples, not additional public vulnerability claims.
Illustrative research taxonomy
| ID | Redacted result |
|---|---|
| BB-001 | Exported account log bridge exposes sensitive operational data |
| BB-002 | Open account interface brokers token material across a trust boundary |
| BB-003 | Cross-origin login-state endpoint leaks authentication context |
| BB-004 | Public cloud business-secret and auth bootstrap material exposure |
| BB-005 | Authorisation replay across a privileged action boundary |
| BB-006 | Validation enforced on outbound, skipped on inbound recipient release |
| BB-007 | Forwarding calldata rebinds asset across cross-domain authorisation |
| BB-008 | Exported broadcast accepts privileged action without intent verification |
| BB-009 | Step-up boundary skipped for sensitive account mutation |
| BB-010 | Patch validation confirms the reported behavior no longer reproduces |