API Exploit Prover

When To Use

Use this after discovery identifies candidate API weaknesses.

Inputs

• candidate_findings
• target_base_url
• auth_and_role_context
• test_data_or_seed_objects
• constraints (noise limits, forbidden write actions)

Confidence Model

• C0: hypothesis only
• C1: suspicious signal
• C2: reproducible behavior anomaly
• C3: exploit primitive proven
• C4: business impact proven