Vulnerability Review

# Skill: Vulnerability Review & Bounty Prioritization

This skill provides guidance on evaluating the impact and validity of security findings.

## 1. False Positive Reduction
Before reporting a finding, run a "Reviewer Cycle":
- **Evidence Collection**: Does the \`fbh_scan\` output contain a clear, reproducible trace?
- **Manual Verification**: Use \`technical_web_fetch\` or \`web_search\` to check if the identified "leak" is actually a public/test key.
- **PoC Verification**: Use \`fbh_verify_exploit\` to see if the vulnerability is actually reachable and exploitable.

## 2. Severity Assessment
Classify findings based on Bug Bounty impact:
- **Critical**: Remote Code Execution (RCE), Complete Auth Bypass, Direct Database Access.
- **High**: Sensitive Data Exposure (PII, Private Keys), Broken Access Control.
- **Medium**: CSRF on critical actions, Insecure Direct Object Reference (IDOR).
- **Low**: Information Disclosure, Minimal config issues.

## 3. Reporting Strategy
Always include:
- A clear **Impact** statement (What can an attacker actually *do*?).
- A **Step-by-step PoC**.
- Remediation advice (MasVS/OWASP reference).