Working standard / version 0.1

The claim is not separate from its evidence.

This is the standard we are adopting. It is not evidence that CVE Hunter has already met it.

Research disciplines

One method, four observation surfaces.

Observe
Adversary infrastructure, campaigns, access paths, and tradecraft.
Changes the test
Turns observed behavior into a testable hypothesis.
Required record
Source provenance, time bounds, confidence, and competing explanations.

The evidence is part of the finding

A future public finding should leave the research system as a bounded evidence bundle, not an unsupported narrative. The bundle must identify the exact source revision, tools, environment, inputs, expected observations, and limitations.

Required controls

Reproducer

A deterministic test must exhibit the candidate behavior under a pinned environment.

Harness negative control

The same harness, with the triggering condition removed, must produce the expected null result. Otherwise the harness may be measuring its own scaffolding.

Patched-revision differential

The reproducer must stop exhibiting the behavior on the relevant fixed revision. This is standard reproduction hygiene, not an invention.

Versioned manifest

Artifacts need immutable identifiers, checksums, source references, toolchain versions, and a statement of what replay verifies. A checksum proves identity; it does not prove correctness by itself.

Publication boundary

The public website cannot read private research repositories. CVE Hunter may export an allowlisted candidate bundle, but that bundle enters this repository in review state. Publication requires disclosure authorization, a public patch, redistribution review, dual-use review, and a non-author pull-request approval.

“Validated” describes our internal gates. “Confirmed vulnerability” belongs to the maintainer or CNA.