A finding ships only when it survives.
Three checks stand between a suspicion and a Rheono finding. The hunt agent proves the weakness once. An independent validator tries to break the proof in a separate session. Then the exploit is replayed without a model, and the request and response are captured as evidence.
Three checks, one verdict
The example below uses the sample report's fictitious finding. The order of the checks is real: nothing reaches your queue before all three agree.
- Hunt agentFound
Sequential order IDs: 41 other customers' orders read.
- Validator agentHeld
Tried to break the PoC. It still reads foreign orders.
- ReplayPassed
Exploit rerun without a model. Same response, request and response captured.
The validator never saw the hunt's work.
The session that finds a weakness is not the session that confirms it. A second agent receives the claim, the endpoint, and the written scope — nothing else — and tries to reproduce the access from scratch. If it cannot get there on its own, the finding does not ship. Killing a candidate carries a reason, and the reason is kept.
Every claim carries its request and response.
An agent can describe an intrusion that never happened in confident detail. So the proof is the captured traffic: the requests that were sent, the responses that came back, and a proof-of-concept you can run yourself. What reaches your queue is the record, not a summary of one.
The exploit reruns on its own.
After validation, the exploit is replayed as a deterministic run. Same request, same response, captured again. The replay is the cheapest possible doubt: it either reproduces, or the finding goes back with the difference recorded.
A control that never fails is not a control.
Advisory entries can carry what was tried and ruled out next to what shipped. The misses are part of the record: they are how you tell a careful hunter from a loud one, and they are published on the advisories page when there is something to learn from them.
A fix is not done when it deploys. It is done when the original attack fails.
After a fix ships, the original attack path is replayed against the live surface. The finding closes with a receipt: the replay date, the result, the evidence. Until then it stays open — or the risk is formally accepted, by a named person, on the record. Your auditor grades that loop; the report is built to survive the grading.
- Who confirms a finding is real?
- A separate validation session reproduces the issue from the claim alone, then the exploit is replayed without model involvement. A named researcher owns the verdict end to end.
- What happens when a check fails?
- The candidate is killed or sent back, with the reason kept. Misses that teach something are published on the advisories page next to the wins.
- What proves a fix worked?
- The original attack is replayed after deployment. The close-out carries the replay date and the evidence; otherwise the risk must be formally accepted, by name, on the record.
See the bar run against your surface.
The free check is read-only and arrives by email. Findings that clear the full bar are what a plan delivers, every hunt.