Recommended usage
Because a post-script runs once per finding with the full finding and scan context, it's the right place for follow-up work that only makes sense after a vulnerability has been identified.
Validation
Have the model re-examine a finding and judge whether it's real and reachable, then emit a verdict you can filter on:
Re-check "{{summary}}" ({{vulnerability_type}}) at {{file_path}}:{{line}}.
Is it exploitable in a default deployment?
Return:
- verdict (string): CONFIRMED, LIKELY, or FALSE_POSITIVE
- reasoning (string)
Cut noise by grading each finding's exploitability before a human ever looks at it.
Check whether a finding was patched
The bundled Patched since post-script compares the finding's file in its owning repository - the primary target or a dependency - with the current remote default branch. It uses a path-scoped diff and commit history without moving the scan's pinned checkout.
The result includes a _chip_patched verdict, found_at_commit, target_commit, and a
manual-review flag. If the default branch cannot be fetched, does not descend from the
scan commit, or the finding path is unsafe, it requests manual review instead of guessing.
Reports
The bundled Report Creator turns each finding into a full, shareable bug-bounty
write-up using the reserved _reserved_report key. It renders as a Report tab on the
finding - see reserved post-scripts.
Produce a polished Markdown report ready to attach to a bug-bounty submission.
Proofs of concept
The bundled PoC Creator asks the model to build and run a local proof of concept, then
returns the resulting Git diff through the reserved _reserved_poc key. It renders as a
PoC tab.
Turn a described vulnerability into a concrete, reproducible proof of concept.
Bounty actor scope
The bundled Is Malicious Actor in scope post-script revalidates the finding and checks
its attacker model against {{extra.bug_bounty_url}}. Selecting it on a scan makes
bug_bounty_url a required extra field. Its verdict appears as an
_chip_is_in_scope chip, alongside the is_valid result.
You can attach several post-scripts to one scan; each runs on every finding. Next: the reserved post-scripts.