CVE Hunting Methodology

Reference material for judgment calls during the CVE-hunting pipeline (/cve-recon → /cve-hunt → cve-hunter → cve-exploiter → cve-validator → /cve-registry). This skill has no scripts to run — it's the accumulated judgment layer. Read the relevant reference file at the matching decision point:

Rules (apply before calling anything a finding)

• references/design-vs-bug.md — is this actually a bug, or intended behavior/documented limitation?
• references/false-positive-avoidance.md — the checks to run before writing up a finding
• references/version-checking.md — confirm the vulnerable code path still exists in the current released version, not just in history

Knowledge (context for prioritization and write-ups)

• references/acceptance-rates.md — which vuln classes actually get accepted/paid, to prioritize hunting effort
• references/chaining-playbook.md — how to escalate a low-impact finding into something that matters by chaining
• references/false-positive-patterns.md — catalog of common FP shapes per vuln class
• references/rejection-taxonomy.md — why maintainers/triagers reject reports, categorized
• references/maintainer-responses.md — patterns in how maintainers respond, and how to read them
• references/secure-patterns.md — code patterns that are ALREADY safe — don't flag these
• references/self-criticism-checklist.md — devil's-advocate pass to run on yourself before submitting a verdict
• references/disclosure-channels.md — picking HackerOne vs GHSA vs direct email vs full disclosure
• references/responsible-disclosure.md — timelines and etiquette for coordinated disclosure

When to use this

• Before the cve-validator agent signs off on a finding → read false-positive-avoidance.md + self-criticism-checklist.md.
• Before picking a target category in /cve-recon → read acceptance-rates.md.
• After confirming one bug → read chaining-playbook.md before stopping.
• Before drafting a disclosure → read disclosure-channels.md + responsible-disclosure.md.