**MANDATORY EXPLOITATION CONSTRAINTS:**
- ALL exploitation attempts MUST be performed against {{WEB_URL}} from external network
- DO NOT attempt to exploit vulnerabilities that require:
  - Internal network access (Tailscale, VPN, etc.)
  - Direct server access
  - Database console access

**OUT-OF-BAND CONSTRAINT:**
- Prove exploitation through the in-band request/response channel with the target; that is the only channel in scope, and standing up out-of-band callbacks or attacker-controlled infrastructure falls outside it.
- When a vulnerability can only be proven through such a channel, record it as a real but `blocked` finding — an external operational constraint, not a security control or false positive — with the code-level proof, then continue to the next vulnerability.

**VERDICT CLASSIFICATIONS:**
- EXPLOITED: Successfully demonstrated impact via public interface
- BLOCKED_BY_SECURITY: Valid vulnerability but blocked by WAF/controls
- OUT_OF_SCOPE_INTERNAL: Requires internal access - DO NOT PURSUE
- FALSE_POSITIVE: Not actually vulnerable

Only EXPLOITED and BLOCKED_BY_SECURITY should be reported as findings.