Every Review scores your report on four checks, in order:
- Code behaves as reported: the mechanism exists, is reachable and works as you describe.
- Attack achieves impact: assuming it does, the attack causes real harm in production.
- Impact mapping: that harm matches an in-scope category in the program's bounty table.
- PoC demonstrates impact: your PoC proves the harm, not just describes it.
Each score is a confidence level, not a coverage percentage. The checks are a chain: if an early one scores low, the later ones are greyed out. So the first low score is where your report needs work.
Next on Monday: how your agent can learn from these scores through the Studio MCP.
Show more
