Guide
How to assess an incoming vulnerability report
Code review helps explain the reported behavior. Deployment checks, authorized testing and product context may also be needed to decide whether a vulnerability exists.
1. Identify the claim and its prerequisites
Record what the researcher says an attacker can do, what access they need and which environment or version is affected. Keep their reproduction steps attributed to them until independently validated.
For example: An authenticated customer with invoices:read can request another account's invoices through the export endpoint. The required permission scope and knowledge of the target account identifier both matter to the assessment.
2. Establish the affected component
Connect the reported target to the repository and applicable revision before deciding. A matching endpoint in a client library is only a lead: a client sending credentials does not prove that the server rejects requests without them.
Find the reported route and record the repository revision. Inspect its middleware and configuration to establish authentication, permission checks and reachability. A function signature alone does not show which request fields middleware can read.
3. Trace the input to the sensitive operation
Follow the account identifier through the handler and data layer. Check whether each operation uses the authenticated account or trusts a caller-supplied identifier. Record file paths and line ranges so another reviewer can inspect the same revision.
4. Check the scope of each defense
A permission to read invoices does not necessarily authorize access to another account's invoices. A safeguard on a refund route is context for the export investigation; it only contradicts the export claim if it also protects that path.
5. Separate code findings from runtime questions
Check whether gateways, feature flags, database permissions or row-level policies could change the deployed behavior. If those controls are outside the inspected scope, record the uncertainty. Lack of a search match is not proof that a defense is absent.
Arrange any reproduction in an authorized, controlled environment. A proposed regression test describes expected behavior; it does not prove that a deployment is exploitable or that a fix has shipped.
6. Record assessment, disposition and severity separately
filtro.dev's automated assessment describes what the available code means for the report. It gives a direct conclusion: Vulnerability confirmed, Likely a vulnerability, More evidence needed, Likely not a valid vulnerability, or Not a valid vulnerability. These conclusions remain advisory until a person reviews the evidence.
A human disposition uses the same evidence outcomes as the automated review: vulnerability confirmed, likely a vulnerability, more evidence needed, likely not a valid vulnerability, or not a valid vulnerability. Severity and remediation apply only when the human or automated decision identifies a vulnerability. Neither a model assessment nor a linked pull request is human verification of remediation.
7. Require evidence before rejecting
A rejection should identify the control that blocks the claimed attack, where it is enforced and why it applies to the reported version and configuration. Missing code, an out-of-scope asset or a similar old report does not disprove a vulnerability. If a material prerequisite is unresolved, ask for the missing evidence instead of dismissing the report.
filtro.dev challenges negative conclusions in a fresh AI review. Your team still approves the response and decision. Confidence scores are not calibrated probabilities, and a second model pass is not proof of correctness.
8. Preserve the open questions and next steps
Record the evidence, remaining uncertainties, reviewer and decision. If more information is needed, identify the missing access, deployment fact or researcher detail. An interrupted provider call may leave an incomplete investigation; check the reason before treating it as an assessment.
Assess a report your team received.
Start with a 14-day free trial with no card required. After that, one workspace is $99 USD a month. Model usage and Agent hosting are paid separately.