Vulnerability Research

Turn a research lead into a defensible finding, a rejected hypothesis, or a precise unanswered question. Work in short loops: hypothesis → discriminating experiment → evidence → next decision. Keep updates brief; retain inputs, traces, and decisions in the task workspace.

Establish the target and the security property

• Identify the artifact or deployment actually examined: revision/build, configuration, architecture/runtime, entry points, and relevant dependencies. Bind observations to that identity.
• Exercise or inspect a normal operation first. A running process, responding port, or successful tool invocation does not establish that the relevant application path works.
• State what must remain true: who may act on which object, what data may cross a boundary, what memory/state must remain valid, or which operation must be atomic. Distinguish a documented requirement from an inferred assumption. Normal traces suggest properties; they do not establish the entire specification (Felmetsger et al., §§3–4).
• Read existing advisories, patches, tests, and design notes when they resolve a specific uncertainty. Absence from public search does not establish novelty. Do not require a literature survey before inspecting a useful local lead.

Select the next hypothesis

Map the relevant chain: controlled input or action → reachable processing → security decision/state → observable consequence. Include callers, transformations, checks, ownership, and error paths needed to explain it.

Prioritize plausible input control, consequential boundaries, changed or complex code, and the cost of resolving uncertainty. Language, a suspicious API, or a severity score alone does not select the best research path.

For each active lead, record one proposed failure, supporting evidence, the strongest alternative explanation, and the observation that would distinguish them. Follow one consequential unknown to an answer; expand to adjacent paths when the result gives a reason. When parallel work is useful, separate independent hypotheses and artifacts, with one integration owner.