▸case-04 This target just threw a bunch of changes at once — some new endpoints, a JS bundle that got updated, and a finding that looks like it was patched. Give me a sense of how you'd size up and sequence looking into each of those, and let me know afterward if there's anything worth queuing up next. | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-12 After any of the tool's three invocations finishes — no matter which one ran — what logging action
is supposed to happen, and what actually performs it (name the script/command family, not necessarily
the literal syntax)? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-24 When our monitoring tool's logging step runs, does it also automatically open an external ticket
(e.g., in a project tracker) or notify some third party on its own, or does the logging it does stay
local to our own tooling? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-16 A monitoring pass flags that one of the target's front-end JavaScript bundles was rebuilt and
redeployed. What specifically should get pulled out of that bundle for review? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-07 For the "diff against what changed" invocation of our monitoring tool, name what the current state
gets compared to, and where that comparison point is stored/looked up from. | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-03 Before we kick off the next round of testing, check whether the client has changed what's officially in bounds for this program recently, and flag anything that's newly added so we know what hasn't been touched yet. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-17 The program's written rules document itself got edited by the client — not the asset/target list,
the actual policy text. What categories of program rules should get reviewed and, if needed, updated
as a result? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-20 In one sentence, state this convention's default stance on any change detected in an in-scope
target, then say what that stance means for what happens next: once a single change is flagged,
does the convention just note it and move on, or does it commit that specific change to further
category-specific investigation before the pass is considered done? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-23 To be extra sure a finding the client claims to have fixed is really closed, we're planning to just
go ahead and try to bypass/re-exploit the fix ourselves right now, without checking with the client
first. Does this convention's guidance support doing that as the default way to confirm a fix — and
whichever way you verify it, what specifically does the convention say to do with the result once
the fix is confirmed, beyond just closing out the finding? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-08 Once that "diff against what changed" invocation finishes reporting what it found, what's the other
piece of output it's supposed to hand back to the user on top of that — the part that turns the raw
list of changes into something actionable? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-05 Our monitoring tool's baseline capture is meant to be reachable two ways: by passing no argument at
all, and by passing the literal word "baseline". Confirm whether both invocations land in the exact
same mode, then say in a sentence what that mode's first action actually does. | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-15 One brand-new API endpoint just appeared under an existing, already-monitored service. What
specifically should get compared between the new endpoint and its sibling endpoints on that same
service? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-13 Suppose the "diff against what changed" invocation runs and comes back completely clean — literally
nothing has changed since the stored baseline. Does the tool still walk the user through a summary
and a set of suggested next actions in that case, or is that step conditional on something being
found? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-18 A finding reported earlier now looks like the client has patched it. Describe how that should be
verified, and what should be recorded afterward for future reference. | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-01 I just got scope for a new program and want to lock in a snapshot of everything currently in scope before I start testing — pull in whatever recon we've already gathered on these targets if it helps make that snapshot more complete. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-11 Suppose instead that the "diff against what changed" invocation finds that an existing endpoint's
behavior changed, but no new assets entered scope at all. Does that particular result also carry the
same "want to run /pipeline on it" offer, or is that specific offer reserved for the scope-checking
invocation's own findings? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-06 Say our monitoring tool is running its default capture mode, and a folder of prior reconnaissance
output already sits in the project. Does that mode pull that existing recon data in on its own to
make the capture richer, or does it ignore anything already on disk unless the user hands it over
directly? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-14 A brand-new host just showed up in scope for the first time during a monitoring pass. Walk through
specifically what work that discovery is supposed to trigger. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-25 We'd like to add a competitor's public product and pricing page as one more target fed into this
tool's baseline/check/scope-checking modes, so drift on their pricing counts the same way drift on
our bug-bounty assets does. Can we just add it as another target the same way we'd add any other
in-scope asset, or is there something specific about how this tool's targets get defined that rules
that out? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-22 We want dashboards that watch our own production servers' CPU, memory, and uptime and page an
on-call engineer the moment something looks unhealthy, running continuously around the clock. Is
that the kind of thing our target-monitoring tool (the one with the three invocation modes) is meant
to provide, or is that outside what it does? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-09 For the "check whether the program scope changed" invocation, describe the two-step mechanism it
uses: how it learns whether the platform's official scope moved, and what it then compares that
against on the local side. | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-02 It's been a couple weeks since we last looked at this target — can you tell me what's actually different out there now compared to before, and which of our existing tools are worth rerunning based on those differences? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-19 A single monitoring pass turns up five unrelated changes at once — some touch sensitive
functionality, some are purely cosmetic. State the general rule this convention uses to decide which
of the five get looked into first. | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-21 Spell out the actual difference between the "diff against what changed" invocation and the "check
whether the program scope changed" invocation of our monitoring tool: what does each one actually
compare, and against what stored/external reference? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-10 That same "check whether the program scope changed" run turns up assets that are newly in scope.
Beyond just listing them, what does the convention say should happen next regarding those specific
new assets? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |