Pentest, bug bounty, own-source bug hunt, mobile/APK, reverse engineering and PR audit are different flows. SecHive treats them as distinct run modes with distinct evidence standards.
Each run mode activates a distinct set of skills, evidence standards and report templates. The proof pack format is identical across modes — what changes is what gets tested and how findings are scoped.
Scoped engagements with approval checkpoints and a deliverable that survives client review. Scope policy loaded before first probe.
HackerOne-shaped reports with deterministic repro, CVSS scoring, and public-safe redaction by default.
Source-uploaded analysis with strict separation between candidate suspicion and validated runtime finding until proof exists.
Exported components, broadcast paths and binder surfaces. Static analysis corroborated by runtime evidence before promotion.
Binary triage, anti-tamper inspection, protocol-field reasoning. Reproduction over speed. Negative evidence retained throughout.
Diff-aware reasoning at pull-request time. Designed to catch regressions and novel patterns without flooding reviewers with noise.
The mode changes the skills activated and the report template. The chain of evidence — sha256 artifacts, cosigned attestation, replay scripts, retained negatives — is identical across all six.
scope_guard runs pre-flight on every mode. Out-of-scope actions are hard-blocked at the skill level, not just logged.
Every promoted finding is accompanied by a cosign-signed report.attestation.json bound to the sha256 artifact index.
Every finding ships with a replay.sh. A reviewer on any matching lab can reproduce the finding without re-running the full pipeline.
| Skill | Pentest | Bug Bounty | Source | Mobile | RE | PR Audit |
|---|---|---|---|---|---|---|
| SK.01 recon_router | ✓ | ✓ | ✓ | — | — | ✓ |
| SK.02 bizlogic_hunter | ✓ | ✓ | ✓ | — | — | — |
| SK.03 api_security | ✓ | ✓ | ✓ | — | — | — |
| SK.04 validation_bypass | ✓ | ✓ | ✓ | — | — | ✓ |
| SK.05 cross_domain_logic | ✓ | ✓ | ✓ | — | — | — |
| SK.06 poc_validator | ✓ | ✓ | ✓ | — | — | — |
| SK.07 apk_inspector | — | — | — | ✓ | — | — |
| SK.08 re_triage | — | — | — | — | ✓ | — |
| SK.09 scope_guard | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| SK.10 report_renderer | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
The fastest evaluation path is a pilot against a real authorized target in the run mode you care about most.
