Map the attack surface
Start from protocol goals, trust boundaries, permissions, assets, user flows, and operational assumptions before treating any finding as meaningful.
Research / Methodology
Reproducibility-first security work for real engineering decisions.
Forge treats security findings as engineering claims that need context, reproduction, impact framing, and responsible handling.
Methodology
The process is intentionally practical: understand the system, test assumptions, show the path, and help teams resolve the issue.
Test claims against evidence
Prefer reproducible behavior, concrete traces, and engineering context over vague severity language or speculative reporting.
Frame impact precisely
Separate exploitability, blast radius, user harm, operational risk, and remediation confidence so teams can prioritize without guesswork.
Resolve responsibly
Support a path from report to fix to validation, with publication choices handled cautiously and only when appropriate.
Standards
Review language should stay precise.
Severity and impact should not outrun the evidence. Findings should be understandable to both security and engineering owners.
- Evidence before assertion
- Reproducibility before severity
- Client-safe communication
- Minimal public claims
- Engineering-ready recommendations
- Responsible disclosure by default