Readiness guides

Why reports get marked N/A — by vulnerability class

The specific reasons a triager rejects each bug class, and the proof that makes a report accept-worthy. Then test your agent on the matching scenario.

• IDOR / BOLA

  Most IDOR reports get marked N/A because they show a different ID, not cross-tenant data. Here is what triagers need to accept an IDOR report.

• Server-Side Request Forgery

  SSRF reports get marked N/A when they show an outbound request but no internal data. Here is the proof triagers need to accept an SSRF report.

• Cross-Site Scripting

  XSS reports get marked N/A when they show reflection or alert(1) but no real theft. Here is the proof triagers need to accept an XSS report.

• SQL Injection

  SQLi reports get marked N/A when they show an error or a delay but never extract data. Here is the proof triagers need to accept a SQL injection report.

• Authentication / JWT bypass

  Auth-bypass and JWT reports get marked N/A when they show a weak token but never access a protected resource. Here is the proof triagers need.