Different disciplines. Different truth.
Pentest, bug bounty, own-source bug hunt, mobile/APK, reverse engineering and PR audit are different flows. SecHive treats them as distinct run modes with distinct evidence standards.
Six modes. One proof standard.
Each run mode activates a distinct set of skills, evidence standards and report templates. The proof pack format is identical across modes — what changes is what gets tested and how findings are scoped.
Pentest
Authorized research with approval checkpoints and evidence organized for technical review. Scope policy is loaded before the first probe.
Bug Bounty
Coordinated-disclosure reports with deterministic reproduction, CVSS context, and public-safe redaction.
Own-Source Bug Hunt
Source-uploaded analysis with strict separation between candidate suspicion and validated runtime finding until proof exists.
APK / Mobile Review
Exported components, broadcast paths and binder surfaces. Static analysis corroborated by runtime evidence before promotion.
Reverse Engineering
Binary triage, anti-tamper inspection, protocol-field reasoning. Reproduction over speed. Negative evidence retained throughout.
PR Audit
Diff-aware reasoning at pull-request time. Designed to catch regressions and novel patterns without flooding reviewers with noise.
Same proof standard. Every mode.
The mode changes the skills activated and the report template. The intended evidence shape includes sha256 artifacts, human reviewer disposition, replay scripts, and retained negative results.
Scope guard
scope_guard runs pre-flight on every mode. Out-of-scope actions are hard-blocked at the skill level, not just logged.
Human review record
Promoted findings are designed to carry a reviewer disposition bound to the sha256 artifact index, keeping automated output separate from the final human decision.
Deterministic replay
Every finding ships with a replay.sh. A reviewer on any matching lab can reproduce the finding without re-running the full pipeline.
| Skill | Pentest | Bug Bounty | Source | Mobile | RE | PR Audit |
|---|---|---|---|---|---|---|
| SK.01 recon_router | ✓ | ✓ | ✓ | — | — | ✓ |
| SK.02 bizlogic_hunter | ✓ | ✓ | ✓ | — | — | — |
| SK.03 api_security | ✓ | ✓ | ✓ | — | — | — |
| SK.04 validation_bypass | ✓ | ✓ | ✓ | — | — | ✓ |
| SK.05 cross_domain_logic | ✓ | ✓ | ✓ | — | — | — |
| SK.06 poc_validator | ✓ | ✓ | ✓ | — | — | — |
| SK.07 apk_inspector | — | — | — | ✓ | — | — |
| SK.08 re_triage | — | — | — | — | ✓ | — |
| SK.09 scope_guard | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| SK.10 report_renderer | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Pick a mode. Bring a scope.
The fastest evaluation path is a pilot against a real authorized target in the run mode you care about most.