h-mmer Triage & Validation
The 7-Question Gate (applied to EVERY finding)
First NO = KILL. Do not continue.
- Q1: Exact HTTP request + response showing the issue RIGHT NOW?
- Q2: Bug class accepted by this program?
- Q3: Asset in-scope, owned by target (not third-party)?
- Q4: Works without admin/privileged access?
- Q5: Not documented behavior or known issue?
- Q6: Impact proved with actual data (not just status code)?
- Q7: Not on the never-submit list?
Never-Submit List
Missing headers (CSP/HSTS/X-Frame-Options), missing SPF/DKIM/DMARC, GraphQL introspection alone, banner/version without exploit, clickjacking without PoC, self-XSS, open redirect alone, SSRF DNS-only, CORS wildcard without credentialed exfil, logout CSRF, rate limit on non-critical, missing cookie flags alone, OAuth client_id alone, OIDC discovery endpoints, SPA client-side config.
4 Pre-Submission Gates
Gate 0 (30 sec): Confirmed with real HTTP? In scope? Reproducible? Evidence?
Gate 1 (2 min): What does attacker walk away with? Real victim? Max 2 preconditions?
Gate 2 (5 min): Searched hacktivity? Read disclosed reports? Not in changelog?
Gate 3 (10 min): Title follows formula? Steps have exact HTTP? CVSS calculated?
Conditional Validity (chain required)
| Finding | Chain Needed | Without Chain |
|---|---|---|
| Open redirect | + OAuth code theft → ATO | KILL |
| SSRF DNS-only | + internal data exfil | KILL |
| CORS wildcard | + credentialed data theft | KILL |
| GraphQL introspection | + auth bypass on mutations | KILL |
| S3 listing | + secrets in bundles | KILL |
| Prompt injection | + IDOR via chatbot | KILL |
Severity Calibration
| Impact | Severity |
|---|---|
| Full ATO, RCE, mass PII exfil | Critical |
| Read/modify other user's private data | High |
| Stored XSS in victim context | Medium-High |
| Info disclosure (sensitive creds) | Medium |
| Info disclosure (non-sensitive) | Low/Info |