From d8a10963a81756e7b61f88e087c3c931272a03b8 Mon Sep 17 00:00:00 2001 From: ezl-keygraph Date: Mon, 31 Aug 2026 21:32:00 +0530 Subject: [PATCH] fix(prompts): scope exploit agents to in-band proof, mark OOB-only findings blocked --- apps/worker/prompts/shared/_exploit-scope.txt | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/apps/worker/prompts/shared/_exploit-scope.txt b/apps/worker/prompts/shared/_exploit-scope.txt index a7db4917..7f1407e5 100644 --- a/apps/worker/prompts/shared/_exploit-scope.txt +++ b/apps/worker/prompts/shared/_exploit-scope.txt @@ -5,6 +5,10 @@ - Direct server access - Database console access +**OUT-OF-BAND CONSTRAINT:** +- Prove exploitation through the in-band request/response channel with the target; that is the only channel in scope, and standing up out-of-band callbacks or attacker-controlled infrastructure falls outside it. +- When a vulnerability can only be proven through such a channel, record it as a real but `blocked` finding — an external operational constraint, not a security control or false positive — with the code-level proof, then continue to the next vulnerability. + **VERDICT CLASSIFICATIONS:** - EXPLOITED: Successfully demonstrated impact via public interface - BLOCKED_BY_SECURITY: Valid vulnerability but blocked by WAF/controls