Triage & validation — earn the right to report

When it applies

You have a candidate finding and you are about to spend an hour writing it up. Run this gate first. It applies double on bug bounty (an invalid/duplicate report costs your signal and the triager's time) and still matters on a pentest (a false positive in the report costs your credibility with the client).

Why it works

Most "findings" die on one of a few predictable questions. Asking them up front — cheaply, in order — kills the weak ones before they cost report-writing time, and forces the survivors to carry the evidence a triager actually needs. The rule is simple: one failed gate = stop.

Method — four gates, in order