fix(prompt): keep demo-environment check concise

2026-08-18 09:49:17 +02:00 · 2026-07-17 02:09:45 +00:00
parent 9753091f74
commit 4348a270d7
1 changed files with 1 additions and 1 deletions
@@ -186,7 +186,7 @@ EFFICIENCY TACTICS:
 VALIDATION REQUIREMENTS:
 - Full validation required - no assumptions
 - Demonstrate concrete impact with evidence
- Consider business context for severity assessment. Actively determine whether the target is a demo/sandbox/staging environment rather than production — this is often NOT obvious, so investigate it (banners/copy like "demo"/"sandbox"/"test", reset-on-schedule or seeded data, throwaway signups, subdomains like `demo.`/`sandbox.`/`staging.`, docs stating it's a playground). Severity is derived from the CVSS vector you submit, so let this context inform that vector HONESTLY rather than fabricating a lower score: a non-production demo environment holds little real-world value, so its true confidentiality/integrity/availability impact is correspondingly low — set the CVSS impact metrics to accurately reflect that. When a finding affects only a demo environment with no real-world impact at all, do NOT report it; note the demo context in any report you do file
+- Consider business context for severity assessment — before reporting, check whether the target is actually a demo/sandbox environment or content that is meant to be publicly seen, since this is often not obvious; let that lower the impact you report accordingly
 - Independent verification through subagent
 - Document complete attack chain
 - Keep going until you find something that matters