Isolated training fixtures. No real targets or live scans.
RESEARCH / AUTHORIZED EVIDENCE INSPECTION
Bug Hunter
Inspect authorized response evidence safely. The hosted engine sends no requests to external targets.
Create a research job
Evidence inspectionOnly response metadata is saved privately. Cookie values are redacted. Request credentials, response bodies, and real users’ data must not be supplied.
Open your private workspace for persistent jobs. The training fixture is a local test of the actual inspection modules.
Safe scanning plan
Checks inspect supplied headers only. Configuration observations remain unverified until independent human review.
Modules requiring additional infrastructure
TLS handshake inspection — not implemented; execution blocked.
Exposed file discovery — not implemented; execution blocked.
Access control / IDOR — not implemented; execution blocked.
Authentication testing — not implemented; execution blocked.
Session lifecycle testing — not implemented; execution blocked.
Input validation / injection — not implemented; execution blocked.
Dependency advisory lookup — not implemented; execution blocked.
Arbitrary-target networking needs a controlled egress worker, address resolution checks, policy-specific modules, and authorized test-account workflows. This hosted app does not claim those capabilities.
AI research advisor
AI-generated planning advice grounded only in the policy and evidence you supplied. It cannot grant authorization.
Disciplined research workflow
- 1Receive authorized target
- 2Read program policy
- 3Map explicit scope
- 4Identify allowed checks
- 5Create safe inspection plan
- 6Review supplied reconnaissance
- 7Inspect sanitized headers
- 8Analyze observations
- 9Validate capture consistency
- 10Flag false-positive risks
- 11Assign preliminary severity
- 12Generate evidence report
- 13Present to human reviewer
- 14Wait for explicit approval