The evidence is part of the finding
A future public finding should leave the research system as a bounded evidence bundle, not an unsupported narrative. The bundle must identify the exact source revision, tools, environment, inputs, expected observations, and limitations.
Required controls
Reproducer
A deterministic test must exhibit the candidate behavior under a pinned environment.
Harness negative control
The same harness, with the triggering condition removed, must produce the expected null result. Otherwise the harness may be measuring its own scaffolding.
Patched-revision differential
The reproducer must stop exhibiting the behavior on the relevant fixed revision. This is standard reproduction hygiene, not an invention.
Versioned manifest
Artifacts need immutable identifiers, checksums, source references, toolchain versions, and a statement of what replay verifies. A checksum proves identity; it does not prove correctness by itself.
Publication boundary
The public website cannot read private research repositories. CVE Hunter may export an allowlisted candidate bundle, but that bundle enters this repository in review state. Publication requires disclosure authorization, a public patch, redistribution review, dual-use review, and a non-author pull-request approval.
“Validated” describes our internal gates. “Confirmed vulnerability” belongs to the maintainer or CNA.