Exploit Verification Standard

Priority: P0 (CRITICAL)

Always-Apply Rules

• No Exploit = No Report: Finding without reproducible PoC is discarded. No exceptions.
• No Theoretical Findings: "This could be exploited if..." → rejected. Demonstrate actual impact.
• No Tool Output as Evidence: Scanner output alone insufficient. Manual verification required.

PoC Construction

Every confirmed finding must include all fields: