security-repro

1# security-repro
2 
3Reproduce **already-fixed, publicly disclosed** vulnerabilities so a reader can
4see the failure mode and confirm the vendor's patch closes it. The audience is
5a whitepaper or an internal control test. The output is a contrast: the
6vulnerable behavior fires, the patched behavior refuses, and nothing real is
7touched.
8 
9## The one hard line (read first)
10 
11This skill exists to reproduce **the past**, not to find **the new**. Everything
12below flows from that.
13 
14- **Only patched or withdrawn issues.** If the vendor has not shipped a fix (or
15  pulled the artifact), stop. Do not proceed on an open/unpatched issue, even a
16  disclosed one.
17- **Use the last known-vulnerable public version** that is already on the
18  internet — the release *before* the fix. You are demonstrating something that
19  already exists publicly, not creating it.
20- **Never develop new exploitation.** No fuzzing for new bugs, no chaining, no
21  variant discovery, no bypassing an *unfixed* control. If reproducing the
22  disclosed mechanism faithfully would require inventing an undisclosed step
23  (e.g. an escape whose mechanism was never published), leave that step out of
24  scope and say so in writing.
25- **Offline, loopback, synthetic.** No third-party host, no real credential, no
26  real target, no real recipient, no persistence, no exfiltration. A successful
27  reproduction means a **local marker or a policy decision is observed**, not
28  that code ran on someone's machine or data left the lab.
29…