RUN.02 — Bug Bounty
Reports a triager will accept on the first read.
Most BBP reports get closed for noise, missing impact or vague repro. SecHive-shaped reports come with a tested replay script, a tightly framed invariant, and a CVSS that you can defend.
Why triage closes reports
- No clear invariant.
- Repro that works on the author's machine and nowhere else.
- Severity inflation without proof.
- Out-of-scope behavior packaged as a finding.
How SecHive avoids each
- Every promoted finding states the broken invariant first.
- Repro is deterministic and packaged in
replay.sh. - CVSS:4.0 vector is bound to the runtime evidence.
- Scope guard refuses out-of-scope action before the agent reaches it.