[
  {
    "run_id": "nextjs-nextjs--CVE-2024-51479-20260318012913",
    "system_id": "nextjs",
    "advisory_id": "nextjs--CVE-2024-51479",
    "repro_profile_id": "nextjs-authz-bypass",
    "verification_status": "verified-real",
    "verification_mode": "real",
    "artifact_mode": "local-fixture",
    "target_env": "local-docker",
    "compose_services": [
      "app"
    ],
    "baseline_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2024-51479-20260318012913/logs/baseline.json"
    ],
    "attack_steps": [
      {
        "kind": "runner",
        "tool": "nextjs.authz-bypass",
        "status": "completed",
        "status_code": 200,
        "result_path": "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2024-51479-20260318012913/logs/attack.json"
      }
    ],
    "browser_refs": [],
    "browser_evidence": {
      "required": false,
      "present": false,
      "refs": [],
      "baseline_refs": [],
      "proof_refs": [],
      "baseline_title": null,
      "proof_title": null,
      "error_kind": null,
      "reason": null
    },
    "container_log_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2024-51479-20260318012913/logs/docker/app.log"
    ],
    "request_log_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2024-51479-20260318012913/logs/attack.json",
      "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2024-51479-20260318012913/logs/baseline.json"
    ],
    "compose_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2024-51479-20260318012913/compose/compose.yaml"
    ],
    "timeline": [
      {
        "at": "2026-03-18T01:29:13+00:00",
        "step": "select-advisory",
        "status": "completed",
        "detail": "nextjs--CVE-2024-51479"
      },
      {
        "at": "2026-03-18T01:29:13+00:00",
        "step": "resolve-repro-profile",
        "status": "completed",
        "detail": "nextjs-authz-bypass"
      },
      {
        "at": "2026-03-18T01:29:13+00:00",
        "step": "doctor",
        "status": "completed",
        "detail": "all checks passed"
      },
      {
        "at": "2026-03-18T01:29:16+00:00",
        "step": "provision-compose-environment",
        "status": "ready",
        "detail": ""
      },
      {
        "at": "2026-03-18T01:29:16+00:00",
        "step": "wait-ready",
        "status": "completed",
        "detail": "baseline urls ready (1)"
      },
      {
        "at": "2026-03-18T01:29:16+00:00",
        "step": "seed-environment",
        "status": "completed",
        "detail": "steps=1"
      },
      {
        "at": "2026-03-18T01:29:16+00:00",
        "step": "baseline-snapshot",
        "status": "completed",
        "detail": "urls=1"
      },
      {
        "at": "2026-03-18T01:29:16+00:00",
        "step": "controlled-attack-chain",
        "status": "completed",
        "detail": "steps=1"
      },
      {
        "at": "2026-03-18T01:29:16+00:00",
        "step": "collect-logs-and-evidence",
        "status": "completed",
        "detail": "container_logs=1"
      },
      {
        "at": "2026-03-18T01:29:17+00:00",
        "step": "cleanup-compose-environment",
        "status": "completed",
        "detail": "docker compose down completed"
      },
      {
        "at": "2026-03-18T01:29:17+00:00",
        "step": "update-registry-and-reports",
        "status": "completed",
        "detail": "nextjs-nextjs--CVE-2024-51479-20260318012913"
      }
    ],
    "success_evaluation": {
      "passed": true,
      "verification_status": "verified-real",
      "blocked_reason": null,
      "assertions": [
        {
          "name": "baseline-ok",
          "kind": "baseline-ok",
          "passed": true,
          "detail": "baseline URLs responded without 5xx or transport errors"
        },
        {
          "name": "runner-success",
          "kind": "runner-success",
          "passed": true,
          "detail": "server-side authorization recheck was bypassed"
        }
      ]
    },
    "historical_status": "verified-real",
    "latest_status": "verified-real",
    "started_at": "2026-03-18T01:29:13+00:00",
    "finished_at": "2026-03-18T01:29:17+00:00",
    "blocked_reason": null,
    "report_refs": {
      "bundle_dir": "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2024-51479-20260318012913",
      "report_md": "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2024-51479-20260318012913/report.md",
      "report_html": "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2024-51479-20260318012913/report.html",
      "timeline": "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2024-51479-20260318012913/timeline.mmd"
    },
    "dashboard_refs": {
      "report_html": "/runs/nextjs-nextjs--CVE-2024-51479-20260318012913/report.html",
      "report_md": "/runs/nextjs-nextjs--CVE-2024-51479-20260318012913/report.md",
      "timeline": "/runs/nextjs-nextjs--CVE-2024-51479-20260318012913/timeline.mmd",
      "bundle": "/runs/nextjs-nextjs--CVE-2024-51479-20260318012913/run.json"
    },
    "browser_links": [],
    "container_links": [
      "/runs/nextjs-nextjs--CVE-2024-51479-20260318012913/logs/docker/app.log"
    ],
    "request_links": [
      "/runs/nextjs-nextjs--CVE-2024-51479-20260318012913/logs/attack.json",
      "/runs/nextjs-nextjs--CVE-2024-51479-20260318012913/logs/baseline.json"
    ],
    "advisory_meta": {
      "canonical_id": "nextjs--CVE-2024-51479",
      "title": "Next.js authorization bypass vulnerability",
      "summary": "### Impact\nIf a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed.\n\n### Patches\nThis issue was patched in Next.js `14.2.15` and later.\n\nIf your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version.\n\n### Workarounds\nThere are no official workarounds for this vulnerability.\n\n#### Credits\nWe'd like to thank [tyage](http://github.com/tyage) (GMO CyberSecurity by IERAE) for responsible disclosure of this issue.",
      "display_name": "Next.js",
      "system_id": "nextjs",
      "category": "frameworks",
      "severity": "low",
      "cvss_score": 3.1,
      "exploit_status": "unknown",
      "published_at": "2024-12-17T15:09:06Z",
      "updated_at": "2025-09-10T21:12:24Z",
      "official_source_url": "https://github.com/vercel/next.js/security/advisories/GHSA-7gfc-8cq8-jh5f",
      "secondary_source_urls": [
        "https://nvd.nist.gov/vuln/detail/CVE-2024-51479",
        "https://github.com/vercel/next.js/commit/1c8234eb20bc8afd396b89999a00f06b61d72d7b",
        "https://github.com/vercel/next.js",
        "https://github.com/vercel/next.js/releases/tag/v14.2.15"
      ],
      "aliases": [
        "CVE-2024-51479",
        "GHSA-7gfc-8cq8-jh5f"
      ],
      "secure_code_topics": [
        "authz-server-side-recheck",
        "proxy-trust-boundary",
        "token-cookie-storage"
      ],
      "verification_status": "verified-real",
      "verification_mode": "real",
      "artifact_mode": "local-fixture",
      "blocked_reason": null,
      "browser_evidence": {
        "required": false,
        "present": false,
        "refs": []
      }
    },
    "profile_meta": {
      "profile_id": "nextjs-authz-bypass",
      "vuln_family": "authz-bypass",
      "provisioning_mode": "real",
      "destructive_risk": "low",
      "cleanup_policy": "destroy",
      "artifact_source": {
        "strategy": "local-minimal-fixture"
      },
      "success_criteria": [
        "Protected route is reachable only after the controlled bypass proof step."
      ],
      "seed_actions": [
        {
          "kind": "note",
          "message": "Seed guest/admin route fixture for server-side recheck."
        }
      ],
      "attack_actions": [
        {
          "kind": "note",
          "message": "Runner performs local authz bypass proof only."
        }
      ],
      "browser_assertions": {
        "required": false
      },
      "allowed_target_types": [
        "lab-local"
      ],
      "required_services": [
        "app"
      ]
    },
    "reasoning_lines": [
      "### Impact\nIf a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed.\n\n### Patches\nThis issue was patched in Next.js `14.2.15` and later.\n\nIf your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version.\n\n### Workarounds\nThere are no official workarounds for this vulnerability.\n\n#### Credits\nWe'd like to thank [tyage](http://github.com/tyage) (GMO CyberSecurity by IERAE) for responsible disclosure of this issue.",
      "Seed guest/admin route fixture for server-side recheck.",
      "Runner performs local authz bypass proof only.",
      "Protected route is reachable only after the controlled bypass proof step."
    ],
    "progress": {
      "completed": 10,
      "skipped": 0,
      "failed": 0,
      "blocked": 0,
      "planned": 0,
      "other": 1
    },
    "artifact_groups": [
      {
        "key": "reports",
        "label": "\u62a5\u544a\u4e0e\u8fd0\u884c\u4ea7\u7269",
        "count": 4,
        "items": [
          {
            "href": "/runs/nextjs-nextjs--CVE-2024-51479-20260318012913/report.html",
            "label": "report.html",
            "kind": "text"
          },
          {
            "href": "/runs/nextjs-nextjs--CVE-2024-51479-20260318012913/report.md",
            "label": "report.md",
            "kind": "text"
          },
          {
            "href": "/runs/nextjs-nextjs--CVE-2024-51479-20260318012913/timeline.mmd",
            "label": "timeline.mmd",
            "kind": "text"
          },
          {
            "href": "/runs/nextjs-nextjs--CVE-2024-51479-20260318012913/run.json",
            "label": "run.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "compose",
        "label": "Compose \u7f16\u6392",
        "count": 1,
        "items": [
          {
            "href": "/runs/nextjs-nextjs--CVE-2024-51479-20260318012913/compose/compose.yaml",
            "label": "compose.yaml",
            "kind": "text"
          }
        ]
      },
      {
        "key": "baseline",
        "label": "\u57fa\u7ebf\u5feb\u7167",
        "count": 1,
        "items": [
          {
            "href": "/runs/nextjs-nextjs--CVE-2024-51479-20260318012913/logs/baseline.json",
            "label": "baseline.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "attack",
        "label": "\u653b\u51fb\u8f93\u51fa",
        "count": 1,
        "items": [
          {
            "href": "/runs/nextjs-nextjs--CVE-2024-51479-20260318012913/logs/attack.json",
            "label": "attack.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "container",
        "label": "\u5bb9\u5668\u65e5\u5fd7",
        "count": 1,
        "items": [
          {
            "href": "/runs/nextjs-nextjs--CVE-2024-51479-20260318012913/logs/docker/app.log",
            "label": "app.log",
            "kind": "text"
          }
        ]
      },
      {
        "key": "requests",
        "label": "\u8bf7\u6c42\u4e0e\u63a2\u6d4b\u65e5\u5fd7",
        "count": 1,
        "items": [
          {
            "href": "/runs/nextjs-nextjs--CVE-2024-51479-20260318012913/logs/attack.json",
            "label": "attack.json",
            "kind": "text"
          }
        ]
      }
    ]
  },
  {
    "run_id": "nextjs-nextjs--CVE-2020-15242-20260318012830",
    "system_id": "nextjs",
    "advisory_id": "nextjs--CVE-2020-15242",
    "repro_profile_id": "nextjs-proxy-boundary",
    "verification_status": "verified-real",
    "verification_mode": "real",
    "artifact_mode": "local-fixture",
    "target_env": "local-docker",
    "compose_services": [
      "app"
    ],
    "baseline_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/baseline.json"
    ],
    "attack_steps": [
      {
        "kind": "runner",
        "tool": "nextjs.proxy-boundary",
        "status": "completed",
        "status_code": 200,
        "result_path": "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/attack.json"
      }
    ],
    "browser_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/assets/baseline.png",
      "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/assets/baseline-dom.html",
      "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/baseline-console.json",
      "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/baseline-network.json",
      "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/baseline-page.json",
      "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/assets/proof.png",
      "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/assets/proof-dom.html",
      "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/proof-console.json",
      "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/proof-network.json",
      "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/proof-page.json"
    ],
    "browser_evidence": {
      "required": true,
      "present": true,
      "refs": [
        "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/assets/baseline.png",
        "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/assets/baseline-dom.html",
        "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/baseline-console.json",
        "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/baseline-network.json",
        "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/baseline-page.json",
        "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/assets/proof.png",
        "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/assets/proof-dom.html",
        "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/proof-console.json",
        "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/proof-network.json",
        "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/proof-page.json"
      ],
      "baseline_refs": [
        "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/assets/baseline.png",
        "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/assets/baseline-dom.html",
        "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/baseline-console.json",
        "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/baseline-network.json",
        "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/baseline-page.json"
      ],
      "proof_refs": [
        "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/assets/proof.png",
        "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/assets/proof-dom.html",
        "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/proof-console.json",
        "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/proof-network.json",
        "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/proof-page.json"
      ],
      "baseline_title": "Next.js Proxy Boundary Fixture",
      "proof_title": "Next.js Proxy Boundary Fixture - proof",
      "error_kind": null,
      "reason": null
    },
    "container_log_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/docker/app.log"
    ],
    "request_log_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/attack.json",
      "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/baseline.json"
    ],
    "compose_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/compose/compose.yaml"
    ],
    "timeline": [
      {
        "at": "2026-03-18T01:28:30+00:00",
        "step": "select-advisory",
        "status": "completed",
        "detail": "nextjs--CVE-2020-15242"
      },
      {
        "at": "2026-03-18T01:28:30+00:00",
        "step": "resolve-repro-profile",
        "status": "completed",
        "detail": "nextjs-proxy-boundary"
      },
      {
        "at": "2026-03-18T01:28:31+00:00",
        "step": "doctor",
        "status": "completed",
        "detail": "all checks passed"
      },
      {
        "at": "2026-03-18T01:28:34+00:00",
        "step": "provision-compose-environment",
        "status": "ready",
        "detail": ""
      },
      {
        "at": "2026-03-18T01:28:34+00:00",
        "step": "wait-ready",
        "status": "completed",
        "detail": "baseline urls ready (1)"
      },
      {
        "at": "2026-03-18T01:28:34+00:00",
        "step": "seed-environment",
        "status": "completed",
        "detail": "steps=1"
      },
      {
        "at": "2026-03-18T01:28:34+00:00",
        "step": "baseline-snapshot",
        "status": "completed",
        "detail": "urls=1"
      },
      {
        "at": "2026-03-18T01:28:34+00:00",
        "step": "browser-replay-before-attack",
        "status": "completed",
        "detail": ""
      },
      {
        "at": "2026-03-18T01:28:34+00:00",
        "step": "controlled-attack-chain",
        "status": "completed",
        "detail": "steps=1"
      },
      {
        "at": "2026-03-18T01:28:35+00:00",
        "step": "browser-replay-after-attack",
        "status": "completed",
        "detail": ""
      },
      {
        "at": "2026-03-18T01:28:35+00:00",
        "step": "collect-logs-and-evidence",
        "status": "completed",
        "detail": "container_logs=1"
      },
      {
        "at": "2026-03-18T01:28:37+00:00",
        "step": "cleanup-compose-environment",
        "status": "completed",
        "detail": "docker compose down completed"
      },
      {
        "at": "2026-03-18T01:28:37+00:00",
        "step": "update-registry-and-reports",
        "status": "completed",
        "detail": "nextjs-nextjs--CVE-2020-15242-20260318012830"
      }
    ],
    "success_evaluation": {
      "passed": true,
      "verification_status": "verified-real",
      "blocked_reason": null,
      "assertions": [
        {
          "name": "baseline-ok",
          "kind": "baseline-ok",
          "passed": true,
          "detail": "baseline URLs responded without 5xx or transport errors"
        },
        {
          "name": "runner-success",
          "kind": "runner-success",
          "passed": true,
          "detail": "trusted forwarded headers crossed the boundary"
        },
        {
          "name": "browser-present",
          "kind": "browser-present",
          "passed": true,
          "detail": "browser evidence captured"
        }
      ]
    },
    "historical_status": "verified-real",
    "latest_status": "verified-real",
    "started_at": "2026-03-18T01:28:30+00:00",
    "finished_at": "2026-03-18T01:28:37+00:00",
    "blocked_reason": null,
    "report_refs": {
      "bundle_dir": "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830",
      "report_md": "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/report.md",
      "report_html": "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/report.html",
      "timeline": "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830/timeline.mmd"
    },
    "dashboard_refs": {
      "report_html": "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/report.html",
      "report_md": "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/report.md",
      "timeline": "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/timeline.mmd",
      "bundle": "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/run.json"
    },
    "browser_links": [
      "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/assets/baseline.png",
      "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/assets/baseline-dom.html",
      "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/baseline-console.json",
      "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/baseline-network.json",
      "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/baseline-page.json",
      "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/assets/proof.png",
      "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/assets/proof-dom.html",
      "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/proof-console.json",
      "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/proof-network.json",
      "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/proof-page.json"
    ],
    "container_links": [
      "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/docker/app.log"
    ],
    "request_links": [
      "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/attack.json",
      "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/baseline.json"
    ],
    "advisory_meta": {},
    "profile_meta": {
      "profile_id": "nextjs-proxy-boundary",
      "vuln_family": "proxy-boundary",
      "provisioning_mode": "real",
      "destructive_risk": "low",
      "cleanup_policy": "destroy",
      "artifact_source": {
        "strategy": "local-minimal-fixture"
      },
      "success_criteria": [
        "Middleware trust-boundary proof is visible on the browser proof page."
      ],
      "seed_actions": [
        {
          "kind": "note",
          "message": "Seed middleware boundary fixture with clean proxy state."
        }
      ],
      "attack_actions": [
        {
          "kind": "note",
          "message": "Runner performs forwarded-header proof against local fixture only."
        }
      ],
      "browser_assertions": {
        "required": true
      },
      "allowed_target_types": [
        "lab-local"
      ],
      "required_services": [
        "app"
      ]
    },
    "reasoning_lines": [
      "Seed middleware boundary fixture with clean proxy state.",
      "Runner performs forwarded-header proof against local fixture only.",
      "Middleware trust-boundary proof is visible on the browser proof page."
    ],
    "progress": {
      "completed": 12,
      "skipped": 0,
      "failed": 0,
      "blocked": 0,
      "planned": 0,
      "other": 1
    },
    "artifact_groups": [
      {
        "key": "reports",
        "label": "\u62a5\u544a\u4e0e\u8fd0\u884c\u4ea7\u7269",
        "count": 4,
        "items": [
          {
            "href": "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/report.html",
            "label": "report.html",
            "kind": "text"
          },
          {
            "href": "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/report.md",
            "label": "report.md",
            "kind": "text"
          },
          {
            "href": "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/timeline.mmd",
            "label": "timeline.mmd",
            "kind": "text"
          },
          {
            "href": "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/run.json",
            "label": "run.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "compose",
        "label": "Compose \u7f16\u6392",
        "count": 1,
        "items": [
          {
            "href": "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/compose/compose.yaml",
            "label": "compose.yaml",
            "kind": "text"
          }
        ]
      },
      {
        "key": "baseline",
        "label": "\u57fa\u7ebf\u5feb\u7167",
        "count": 1,
        "items": [
          {
            "href": "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/baseline.json",
            "label": "baseline.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "attack",
        "label": "\u653b\u51fb\u8f93\u51fa",
        "count": 1,
        "items": [
          {
            "href": "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/attack.json",
            "label": "attack.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "browser",
        "label": "\u6d4f\u89c8\u5668\u8bc1\u636e",
        "count": 10,
        "items": [
          {
            "href": "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/assets/baseline.png",
            "label": "baseline.png",
            "kind": "image"
          },
          {
            "href": "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/assets/baseline-dom.html",
            "label": "baseline-dom.html",
            "kind": "text"
          },
          {
            "href": "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/baseline-console.json",
            "label": "baseline-console.json",
            "kind": "text"
          },
          {
            "href": "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/baseline-network.json",
            "label": "baseline-network.json",
            "kind": "text"
          },
          {
            "href": "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/baseline-page.json",
            "label": "baseline-page.json",
            "kind": "text"
          },
          {
            "href": "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/assets/proof.png",
            "label": "proof.png",
            "kind": "image"
          },
          {
            "href": "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/assets/proof-dom.html",
            "label": "proof-dom.html",
            "kind": "text"
          },
          {
            "href": "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/proof-console.json",
            "label": "proof-console.json",
            "kind": "text"
          },
          {
            "href": "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/proof-network.json",
            "label": "proof-network.json",
            "kind": "text"
          },
          {
            "href": "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/proof-page.json",
            "label": "proof-page.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "container",
        "label": "\u5bb9\u5668\u65e5\u5fd7",
        "count": 1,
        "items": [
          {
            "href": "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/docker/app.log",
            "label": "app.log",
            "kind": "text"
          }
        ]
      },
      {
        "key": "requests",
        "label": "\u8bf7\u6c42\u4e0e\u63a2\u6d4b\u65e5\u5fd7",
        "count": 1,
        "items": [
          {
            "href": "/runs/nextjs-nextjs--CVE-2020-15242-20260318012830/logs/attack.json",
            "label": "attack.json",
            "kind": "text"
          }
        ]
      }
    ]
  },
  {
    "run_id": "gitea-gitea--CVE-2021-28378-20260318012813",
    "system_id": "gitea",
    "advisory_id": "gitea--CVE-2021-28378",
    "repro_profile_id": "gitea-xss",
    "verification_status": "verified-real",
    "verification_mode": "real",
    "artifact_mode": "local-fixture",
    "target_env": "local-docker",
    "compose_services": [
      "app"
    ],
    "baseline_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/baseline.json"
    ],
    "attack_steps": [
      {
        "kind": "runner",
        "tool": "gitea.xss",
        "status": "completed",
        "status_code": 200,
        "result_path": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/attack.json"
      }
    ],
    "browser_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/assets/baseline.png",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/assets/baseline-dom.html",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/baseline-console.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/baseline-network.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/baseline-page.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/assets/proof.png",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/assets/proof-dom.html",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/proof-console.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/proof-network.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/proof-page.json"
    ],
    "browser_evidence": {
      "required": true,
      "present": true,
      "refs": [
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/assets/baseline.png",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/assets/baseline-dom.html",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/baseline-console.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/baseline-network.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/baseline-page.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/assets/proof.png",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/assets/proof-dom.html",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/proof-console.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/proof-network.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/proof-page.json"
      ],
      "baseline_refs": [
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/assets/baseline.png",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/assets/baseline-dom.html",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/baseline-console.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/baseline-network.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/baseline-page.json"
      ],
      "proof_refs": [
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/assets/proof.png",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/assets/proof-dom.html",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/proof-console.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/proof-network.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/proof-page.json"
      ],
      "baseline_title": "Gitea Stored XSS Fixture",
      "proof_title": "Gitea Stored XSS Fixture - proof",
      "error_kind": null,
      "reason": null
    },
    "container_log_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/docker/app.log"
    ],
    "request_log_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/attack.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/baseline.json"
    ],
    "compose_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/compose/compose.yaml"
    ],
    "timeline": [
      {
        "at": "2026-03-18T01:28:13+00:00",
        "step": "select-advisory",
        "status": "completed",
        "detail": "gitea--CVE-2021-28378"
      },
      {
        "at": "2026-03-18T01:28:13+00:00",
        "step": "resolve-repro-profile",
        "status": "completed",
        "detail": "gitea-xss"
      },
      {
        "at": "2026-03-18T01:28:13+00:00",
        "step": "doctor",
        "status": "completed",
        "detail": "all checks passed"
      },
      {
        "at": "2026-03-18T01:28:16+00:00",
        "step": "provision-compose-environment",
        "status": "ready",
        "detail": ""
      },
      {
        "at": "2026-03-18T01:28:16+00:00",
        "step": "wait-ready",
        "status": "completed",
        "detail": "baseline urls ready (1)"
      },
      {
        "at": "2026-03-18T01:28:16+00:00",
        "step": "seed-environment",
        "status": "completed",
        "detail": "steps=1"
      },
      {
        "at": "2026-03-18T01:28:16+00:00",
        "step": "baseline-snapshot",
        "status": "completed",
        "detail": "urls=1"
      },
      {
        "at": "2026-03-18T01:28:17+00:00",
        "step": "browser-replay-before-attack",
        "status": "completed",
        "detail": ""
      },
      {
        "at": "2026-03-18T01:28:17+00:00",
        "step": "controlled-attack-chain",
        "status": "completed",
        "detail": "steps=1"
      },
      {
        "at": "2026-03-18T01:28:18+00:00",
        "step": "browser-replay-after-attack",
        "status": "completed",
        "detail": ""
      },
      {
        "at": "2026-03-18T01:28:18+00:00",
        "step": "collect-logs-and-evidence",
        "status": "completed",
        "detail": "container_logs=1"
      },
      {
        "at": "2026-03-18T01:28:19+00:00",
        "step": "cleanup-compose-environment",
        "status": "completed",
        "detail": "docker compose down completed"
      },
      {
        "at": "2026-03-18T01:28:19+00:00",
        "step": "update-registry-and-reports",
        "status": "completed",
        "detail": "gitea-gitea--CVE-2021-28378-20260318012813"
      }
    ],
    "success_evaluation": {
      "passed": true,
      "verification_status": "verified-real",
      "blocked_reason": null,
      "assertions": [
        {
          "name": "baseline-ok",
          "kind": "baseline-ok",
          "passed": true,
          "detail": "baseline URLs responded without 5xx or transport errors"
        },
        {
          "name": "runner-success",
          "kind": "runner-success",
          "passed": true,
          "detail": "stored payload rendered inside the browser proof page"
        },
        {
          "name": "browser-present",
          "kind": "browser-present",
          "passed": true,
          "detail": "browser evidence captured"
        }
      ]
    },
    "historical_status": "verified-real",
    "latest_status": "verified-real",
    "started_at": "2026-03-18T01:28:13+00:00",
    "finished_at": "2026-03-18T01:28:19+00:00",
    "blocked_reason": null,
    "report_refs": {
      "bundle_dir": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813",
      "report_md": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/report.md",
      "report_html": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/report.html",
      "timeline": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2021-28378-20260318012813/timeline.mmd"
    },
    "dashboard_refs": {
      "report_html": "/runs/gitea-gitea--CVE-2021-28378-20260318012813/report.html",
      "report_md": "/runs/gitea-gitea--CVE-2021-28378-20260318012813/report.md",
      "timeline": "/runs/gitea-gitea--CVE-2021-28378-20260318012813/timeline.mmd",
      "bundle": "/runs/gitea-gitea--CVE-2021-28378-20260318012813/run.json"
    },
    "browser_links": [
      "/runs/gitea-gitea--CVE-2021-28378-20260318012813/assets/baseline.png",
      "/runs/gitea-gitea--CVE-2021-28378-20260318012813/assets/baseline-dom.html",
      "/runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/baseline-console.json",
      "/runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/baseline-network.json",
      "/runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/baseline-page.json",
      "/runs/gitea-gitea--CVE-2021-28378-20260318012813/assets/proof.png",
      "/runs/gitea-gitea--CVE-2021-28378-20260318012813/assets/proof-dom.html",
      "/runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/proof-console.json",
      "/runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/proof-network.json",
      "/runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/proof-page.json"
    ],
    "container_links": [
      "/runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/docker/app.log"
    ],
    "request_links": [
      "/runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/attack.json",
      "/runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/baseline.json"
    ],
    "advisory_meta": {},
    "profile_meta": {
      "profile_id": "gitea-xss",
      "vuln_family": "xss",
      "provisioning_mode": "real",
      "destructive_risk": "low",
      "cleanup_policy": "destroy",
      "artifact_source": {
        "strategy": "local-minimal-fixture"
      },
      "success_criteria": [
        "Browser proof page renders the stored XSS marker after the controlled payload."
      ],
      "seed_actions": [
        {
          "kind": "note",
          "message": "Seed stored content page before browser proof capture."
        }
      ],
      "attack_actions": [
        {
          "kind": "note",
          "message": "Runner stores inert script payload and captures proof page."
        }
      ],
      "browser_assertions": {
        "required": true
      },
      "allowed_target_types": [
        "lab-local"
      ],
      "required_services": [
        "app"
      ]
    },
    "reasoning_lines": [
      "Seed stored content page before browser proof capture.",
      "Runner stores inert script payload and captures proof page.",
      "Browser proof page renders the stored XSS marker after the controlled payload."
    ],
    "progress": {
      "completed": 12,
      "skipped": 0,
      "failed": 0,
      "blocked": 0,
      "planned": 0,
      "other": 1
    },
    "artifact_groups": [
      {
        "key": "reports",
        "label": "\u62a5\u544a\u4e0e\u8fd0\u884c\u4ea7\u7269",
        "count": 4,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2021-28378-20260318012813/report.html",
            "label": "report.html",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2021-28378-20260318012813/report.md",
            "label": "report.md",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2021-28378-20260318012813/timeline.mmd",
            "label": "timeline.mmd",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2021-28378-20260318012813/run.json",
            "label": "run.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "compose",
        "label": "Compose \u7f16\u6392",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2021-28378-20260318012813/compose/compose.yaml",
            "label": "compose.yaml",
            "kind": "text"
          }
        ]
      },
      {
        "key": "baseline",
        "label": "\u57fa\u7ebf\u5feb\u7167",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/baseline.json",
            "label": "baseline.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "attack",
        "label": "\u653b\u51fb\u8f93\u51fa",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/attack.json",
            "label": "attack.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "browser",
        "label": "\u6d4f\u89c8\u5668\u8bc1\u636e",
        "count": 10,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2021-28378-20260318012813/assets/baseline.png",
            "label": "baseline.png",
            "kind": "image"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2021-28378-20260318012813/assets/baseline-dom.html",
            "label": "baseline-dom.html",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/baseline-console.json",
            "label": "baseline-console.json",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/baseline-network.json",
            "label": "baseline-network.json",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/baseline-page.json",
            "label": "baseline-page.json",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2021-28378-20260318012813/assets/proof.png",
            "label": "proof.png",
            "kind": "image"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2021-28378-20260318012813/assets/proof-dom.html",
            "label": "proof-dom.html",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/proof-console.json",
            "label": "proof-console.json",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/proof-network.json",
            "label": "proof-network.json",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/proof-page.json",
            "label": "proof-page.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "container",
        "label": "\u5bb9\u5668\u65e5\u5fd7",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/docker/app.log",
            "label": "app.log",
            "kind": "text"
          }
        ]
      },
      {
        "key": "requests",
        "label": "\u8bf7\u6c42\u4e0e\u63a2\u6d4b\u65e5\u5fd7",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2021-28378-20260318012813/logs/attack.json",
            "label": "attack.json",
            "kind": "text"
          }
        ]
      }
    ]
  },
  {
    "run_id": "gitea-gitea--CVE-2020-13246-20260318012806",
    "system_id": "gitea",
    "advisory_id": "gitea--CVE-2020-13246",
    "repro_profile_id": "gitea-proxy-boundary",
    "verification_status": "verified-real",
    "verification_mode": "real",
    "artifact_mode": "local-fixture",
    "target_env": "local-docker",
    "compose_services": [
      "app"
    ],
    "baseline_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/baseline.json"
    ],
    "attack_steps": [
      {
        "kind": "runner",
        "tool": "gitea.proxy-boundary",
        "status": "completed",
        "status_code": 200,
        "result_path": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/attack.json"
      }
    ],
    "browser_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/assets/baseline.png",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/assets/baseline-dom.html",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/baseline-console.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/baseline-network.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/baseline-page.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/assets/proof.png",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/assets/proof-dom.html",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/proof-console.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/proof-network.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/proof-page.json"
    ],
    "browser_evidence": {
      "required": true,
      "present": true,
      "refs": [
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/assets/baseline.png",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/assets/baseline-dom.html",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/baseline-console.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/baseline-network.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/baseline-page.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/assets/proof.png",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/assets/proof-dom.html",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/proof-console.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/proof-network.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/proof-page.json"
      ],
      "baseline_refs": [
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/assets/baseline.png",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/assets/baseline-dom.html",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/baseline-console.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/baseline-network.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/baseline-page.json"
      ],
      "proof_refs": [
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/assets/proof.png",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/assets/proof-dom.html",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/proof-console.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/proof-network.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/proof-page.json"
      ],
      "baseline_title": "Gitea Proxy Boundary Fixture",
      "proof_title": "Gitea Proxy Boundary Fixture - proof",
      "error_kind": null,
      "reason": null
    },
    "container_log_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/docker/app.log"
    ],
    "request_log_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/attack.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/baseline.json"
    ],
    "compose_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/compose/compose.yaml"
    ],
    "timeline": [
      {
        "at": "2026-03-18T01:28:06+00:00",
        "step": "select-advisory",
        "status": "completed",
        "detail": "gitea--CVE-2020-13246"
      },
      {
        "at": "2026-03-18T01:28:06+00:00",
        "step": "resolve-repro-profile",
        "status": "completed",
        "detail": "gitea-proxy-boundary"
      },
      {
        "at": "2026-03-18T01:28:07+00:00",
        "step": "doctor",
        "status": "completed",
        "detail": "all checks passed"
      },
      {
        "at": "2026-03-18T01:28:10+00:00",
        "step": "provision-compose-environment",
        "status": "ready",
        "detail": ""
      },
      {
        "at": "2026-03-18T01:28:10+00:00",
        "step": "wait-ready",
        "status": "completed",
        "detail": "baseline urls ready (1)"
      },
      {
        "at": "2026-03-18T01:28:10+00:00",
        "step": "seed-environment",
        "status": "completed",
        "detail": "steps=1"
      },
      {
        "at": "2026-03-18T01:28:10+00:00",
        "step": "baseline-snapshot",
        "status": "completed",
        "detail": "urls=1"
      },
      {
        "at": "2026-03-18T01:28:10+00:00",
        "step": "browser-replay-before-attack",
        "status": "completed",
        "detail": ""
      },
      {
        "at": "2026-03-18T01:28:10+00:00",
        "step": "controlled-attack-chain",
        "status": "completed",
        "detail": "steps=1"
      },
      {
        "at": "2026-03-18T01:28:11+00:00",
        "step": "browser-replay-after-attack",
        "status": "completed",
        "detail": ""
      },
      {
        "at": "2026-03-18T01:28:11+00:00",
        "step": "collect-logs-and-evidence",
        "status": "completed",
        "detail": "container_logs=1"
      },
      {
        "at": "2026-03-18T01:28:13+00:00",
        "step": "cleanup-compose-environment",
        "status": "completed",
        "detail": "docker compose down completed"
      },
      {
        "at": "2026-03-18T01:28:13+00:00",
        "step": "update-registry-and-reports",
        "status": "completed",
        "detail": "gitea-gitea--CVE-2020-13246-20260318012806"
      }
    ],
    "success_evaluation": {
      "passed": true,
      "verification_status": "verified-real",
      "blocked_reason": null,
      "assertions": [
        {
          "name": "baseline-ok",
          "kind": "baseline-ok",
          "passed": true,
          "detail": "baseline URLs responded without 5xx or transport errors"
        },
        {
          "name": "runner-success",
          "kind": "runner-success",
          "passed": true,
          "detail": "trusted forwarded headers crossed the boundary"
        },
        {
          "name": "browser-present",
          "kind": "browser-present",
          "passed": true,
          "detail": "browser evidence captured"
        }
      ]
    },
    "historical_status": "verified-real",
    "latest_status": "verified-real",
    "started_at": "2026-03-18T01:28:06+00:00",
    "finished_at": "2026-03-18T01:28:13+00:00",
    "blocked_reason": null,
    "report_refs": {
      "bundle_dir": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806",
      "report_md": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/report.md",
      "report_html": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/report.html",
      "timeline": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2020-13246-20260318012806/timeline.mmd"
    },
    "dashboard_refs": {
      "report_html": "/runs/gitea-gitea--CVE-2020-13246-20260318012806/report.html",
      "report_md": "/runs/gitea-gitea--CVE-2020-13246-20260318012806/report.md",
      "timeline": "/runs/gitea-gitea--CVE-2020-13246-20260318012806/timeline.mmd",
      "bundle": "/runs/gitea-gitea--CVE-2020-13246-20260318012806/run.json"
    },
    "browser_links": [
      "/runs/gitea-gitea--CVE-2020-13246-20260318012806/assets/baseline.png",
      "/runs/gitea-gitea--CVE-2020-13246-20260318012806/assets/baseline-dom.html",
      "/runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/baseline-console.json",
      "/runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/baseline-network.json",
      "/runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/baseline-page.json",
      "/runs/gitea-gitea--CVE-2020-13246-20260318012806/assets/proof.png",
      "/runs/gitea-gitea--CVE-2020-13246-20260318012806/assets/proof-dom.html",
      "/runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/proof-console.json",
      "/runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/proof-network.json",
      "/runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/proof-page.json"
    ],
    "container_links": [
      "/runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/docker/app.log"
    ],
    "request_links": [
      "/runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/attack.json",
      "/runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/baseline.json"
    ],
    "advisory_meta": {},
    "profile_meta": {
      "profile_id": "gitea-proxy-boundary",
      "vuln_family": "proxy-boundary",
      "provisioning_mode": "real",
      "destructive_risk": "low",
      "cleanup_policy": "destroy",
      "artifact_source": {
        "strategy": "local-minimal-fixture"
      },
      "success_criteria": [
        "Local fixture proves trusted proxy headers cross the admin boundary."
      ],
      "seed_actions": [
        {
          "kind": "note",
          "message": "Seed forwarded-header boundary fixture with clean state."
        }
      ],
      "attack_actions": [
        {
          "kind": "note",
          "message": "Runner performs local forwarded-header trust proof only inside the fixture."
        }
      ],
      "browser_assertions": {
        "required": true
      },
      "allowed_target_types": [
        "lab-local"
      ],
      "required_services": [
        "app"
      ]
    },
    "reasoning_lines": [
      "Seed forwarded-header boundary fixture with clean state.",
      "Runner performs local forwarded-header trust proof only inside the fixture.",
      "Local fixture proves trusted proxy headers cross the admin boundary."
    ],
    "progress": {
      "completed": 12,
      "skipped": 0,
      "failed": 0,
      "blocked": 0,
      "planned": 0,
      "other": 1
    },
    "artifact_groups": [
      {
        "key": "reports",
        "label": "\u62a5\u544a\u4e0e\u8fd0\u884c\u4ea7\u7269",
        "count": 4,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2020-13246-20260318012806/report.html",
            "label": "report.html",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2020-13246-20260318012806/report.md",
            "label": "report.md",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2020-13246-20260318012806/timeline.mmd",
            "label": "timeline.mmd",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2020-13246-20260318012806/run.json",
            "label": "run.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "compose",
        "label": "Compose \u7f16\u6392",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2020-13246-20260318012806/compose/compose.yaml",
            "label": "compose.yaml",
            "kind": "text"
          }
        ]
      },
      {
        "key": "baseline",
        "label": "\u57fa\u7ebf\u5feb\u7167",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/baseline.json",
            "label": "baseline.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "attack",
        "label": "\u653b\u51fb\u8f93\u51fa",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/attack.json",
            "label": "attack.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "browser",
        "label": "\u6d4f\u89c8\u5668\u8bc1\u636e",
        "count": 10,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2020-13246-20260318012806/assets/baseline.png",
            "label": "baseline.png",
            "kind": "image"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2020-13246-20260318012806/assets/baseline-dom.html",
            "label": "baseline-dom.html",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/baseline-console.json",
            "label": "baseline-console.json",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/baseline-network.json",
            "label": "baseline-network.json",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/baseline-page.json",
            "label": "baseline-page.json",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2020-13246-20260318012806/assets/proof.png",
            "label": "proof.png",
            "kind": "image"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2020-13246-20260318012806/assets/proof-dom.html",
            "label": "proof-dom.html",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/proof-console.json",
            "label": "proof-console.json",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/proof-network.json",
            "label": "proof-network.json",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/proof-page.json",
            "label": "proof-page.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "container",
        "label": "\u5bb9\u5668\u65e5\u5fd7",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/docker/app.log",
            "label": "app.log",
            "kind": "text"
          }
        ]
      },
      {
        "key": "requests",
        "label": "\u8bf7\u6c42\u4e0e\u63a2\u6d4b\u65e5\u5fd7",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2020-13246-20260318012806/logs/attack.json",
            "label": "attack.json",
            "kind": "text"
          }
        ]
      }
    ]
  },
  {
    "run_id": "gitea-gitea--CVE-2018-15192-20260318012749",
    "system_id": "gitea",
    "advisory_id": "gitea--CVE-2018-15192",
    "repro_profile_id": "gitea-ssrf",
    "verification_status": "verified-real",
    "verification_mode": "real",
    "artifact_mode": "local-fixture",
    "target_env": "local-docker",
    "compose_services": [
      "app"
    ],
    "baseline_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-15192-20260318012749/logs/baseline.json"
    ],
    "attack_steps": [
      {
        "kind": "runner",
        "tool": "gitea.ssrf",
        "status": "completed",
        "status_code": 200,
        "result_path": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-15192-20260318012749/logs/attack.json"
      }
    ],
    "browser_refs": [],
    "browser_evidence": {
      "required": false,
      "present": false,
      "refs": [],
      "baseline_refs": [],
      "proof_refs": [],
      "baseline_title": null,
      "proof_title": null,
      "error_kind": null,
      "reason": null
    },
    "container_log_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-15192-20260318012749/logs/docker/app.log"
    ],
    "request_log_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-15192-20260318012749/logs/attack.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-15192-20260318012749/logs/baseline.json"
    ],
    "compose_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-15192-20260318012749/compose/compose.yaml"
    ],
    "timeline": [
      {
        "at": "2026-03-18T01:27:49+00:00",
        "step": "select-advisory",
        "status": "completed",
        "detail": "gitea--CVE-2018-15192"
      },
      {
        "at": "2026-03-18T01:27:49+00:00",
        "step": "resolve-repro-profile",
        "status": "completed",
        "detail": "gitea-ssrf"
      },
      {
        "at": "2026-03-18T01:27:49+00:00",
        "step": "doctor",
        "status": "completed",
        "detail": "all checks passed"
      },
      {
        "at": "2026-03-18T01:27:52+00:00",
        "step": "provision-compose-environment",
        "status": "ready",
        "detail": ""
      },
      {
        "at": "2026-03-18T01:27:52+00:00",
        "step": "wait-ready",
        "status": "completed",
        "detail": "baseline urls ready (1)"
      },
      {
        "at": "2026-03-18T01:27:52+00:00",
        "step": "seed-environment",
        "status": "completed",
        "detail": "steps=1"
      },
      {
        "at": "2026-03-18T01:27:52+00:00",
        "step": "baseline-snapshot",
        "status": "completed",
        "detail": "urls=1"
      },
      {
        "at": "2026-03-18T01:27:52+00:00",
        "step": "controlled-attack-chain",
        "status": "completed",
        "detail": "steps=1"
      },
      {
        "at": "2026-03-18T01:27:52+00:00",
        "step": "collect-logs-and-evidence",
        "status": "completed",
        "detail": "container_logs=1"
      },
      {
        "at": "2026-03-18T01:27:54+00:00",
        "step": "cleanup-compose-environment",
        "status": "completed",
        "detail": "docker compose down completed"
      },
      {
        "at": "2026-03-18T01:27:54+00:00",
        "step": "update-registry-and-reports",
        "status": "completed",
        "detail": "gitea-gitea--CVE-2018-15192-20260318012749"
      }
    ],
    "success_evaluation": {
      "passed": true,
      "verification_status": "verified-real",
      "blocked_reason": null,
      "assertions": [
        {
          "name": "baseline-ok",
          "kind": "baseline-ok",
          "passed": true,
          "detail": "baseline URLs responded without 5xx or transport errors"
        },
        {
          "name": "runner-success",
          "kind": "runner-success",
          "passed": true,
          "detail": "server-side callback reached the local sink"
        }
      ]
    },
    "historical_status": "verified-real",
    "latest_status": "verified-real",
    "started_at": "2026-03-18T01:27:49+00:00",
    "finished_at": "2026-03-18T01:27:54+00:00",
    "blocked_reason": null,
    "report_refs": {
      "bundle_dir": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-15192-20260318012749",
      "report_md": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-15192-20260318012749/report.md",
      "report_html": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-15192-20260318012749/report.html",
      "timeline": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-15192-20260318012749/timeline.mmd"
    },
    "dashboard_refs": {
      "report_html": "/runs/gitea-gitea--CVE-2018-15192-20260318012749/report.html",
      "report_md": "/runs/gitea-gitea--CVE-2018-15192-20260318012749/report.md",
      "timeline": "/runs/gitea-gitea--CVE-2018-15192-20260318012749/timeline.mmd",
      "bundle": "/runs/gitea-gitea--CVE-2018-15192-20260318012749/run.json"
    },
    "browser_links": [],
    "container_links": [
      "/runs/gitea-gitea--CVE-2018-15192-20260318012749/logs/docker/app.log"
    ],
    "request_links": [
      "/runs/gitea-gitea--CVE-2018-15192-20260318012749/logs/attack.json",
      "/runs/gitea-gitea--CVE-2018-15192-20260318012749/logs/baseline.json"
    ],
    "advisory_meta": {},
    "profile_meta": {
      "profile_id": "gitea-ssrf",
      "vuln_family": "ssrf",
      "provisioning_mode": "real",
      "destructive_risk": "low",
      "cleanup_policy": "destroy",
      "artifact_source": {
        "strategy": "local-minimal-fixture"
      },
      "success_criteria": [
        "Server-side callback reaches the local sink and is recorded in proof output."
      ],
      "seed_actions": [
        {
          "kind": "note",
          "message": "Seed local sink counters only."
        }
      ],
      "attack_actions": [
        {
          "kind": "note",
          "message": "Runner triggers callback strictly to local sink endpoint."
        }
      ],
      "browser_assertions": {
        "required": false
      },
      "allowed_target_types": [
        "lab-local"
      ],
      "required_services": [
        "app"
      ]
    },
    "reasoning_lines": [
      "Seed local sink counters only.",
      "Runner triggers callback strictly to local sink endpoint.",
      "Server-side callback reaches the local sink and is recorded in proof output."
    ],
    "progress": {
      "completed": 10,
      "skipped": 0,
      "failed": 0,
      "blocked": 0,
      "planned": 0,
      "other": 1
    },
    "artifact_groups": [
      {
        "key": "reports",
        "label": "\u62a5\u544a\u4e0e\u8fd0\u884c\u4ea7\u7269",
        "count": 4,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2018-15192-20260318012749/report.html",
            "label": "report.html",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2018-15192-20260318012749/report.md",
            "label": "report.md",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2018-15192-20260318012749/timeline.mmd",
            "label": "timeline.mmd",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2018-15192-20260318012749/run.json",
            "label": "run.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "compose",
        "label": "Compose \u7f16\u6392",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2018-15192-20260318012749/compose/compose.yaml",
            "label": "compose.yaml",
            "kind": "text"
          }
        ]
      },
      {
        "key": "baseline",
        "label": "\u57fa\u7ebf\u5feb\u7167",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2018-15192-20260318012749/logs/baseline.json",
            "label": "baseline.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "attack",
        "label": "\u653b\u51fb\u8f93\u51fa",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2018-15192-20260318012749/logs/attack.json",
            "label": "attack.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "container",
        "label": "\u5bb9\u5668\u65e5\u5fd7",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2018-15192-20260318012749/logs/docker/app.log",
            "label": "app.log",
            "kind": "text"
          }
        ]
      },
      {
        "key": "requests",
        "label": "\u8bf7\u6c42\u4e0e\u63a2\u6d4b\u65e5\u5fd7",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2018-15192-20260318012749/logs/attack.json",
            "label": "attack.json",
            "kind": "text"
          }
        ]
      }
    ]
  },
  {
    "run_id": "gitea-gitea--CVE-2025-68940-20260318012708",
    "system_id": "gitea",
    "advisory_id": "gitea--CVE-2025-68940",
    "repro_profile_id": "gitea-authz-bypass",
    "verification_status": "verified-real",
    "verification_mode": "real",
    "artifact_mode": "local-fixture",
    "target_env": "local-docker",
    "compose_services": [
      "app"
    ],
    "baseline_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2025-68940-20260318012708/logs/baseline.json"
    ],
    "attack_steps": [
      {
        "kind": "runner",
        "tool": "gitea.authz-bypass",
        "status": "completed",
        "status_code": 200,
        "result_path": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2025-68940-20260318012708/logs/attack.json"
      }
    ],
    "browser_refs": [],
    "browser_evidence": {
      "required": false,
      "present": false,
      "refs": [],
      "baseline_refs": [],
      "proof_refs": [],
      "baseline_title": null,
      "proof_title": null,
      "error_kind": null,
      "reason": null
    },
    "container_log_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2025-68940-20260318012708/logs/docker/app.log"
    ],
    "request_log_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2025-68940-20260318012708/logs/attack.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2025-68940-20260318012708/logs/baseline.json"
    ],
    "compose_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2025-68940-20260318012708/compose/compose.yaml"
    ],
    "timeline": [
      {
        "at": "2026-03-18T01:27:08+00:00",
        "step": "select-advisory",
        "status": "completed",
        "detail": "gitea--CVE-2025-68940"
      },
      {
        "at": "2026-03-18T01:27:08+00:00",
        "step": "resolve-repro-profile",
        "status": "completed",
        "detail": "gitea-authz-bypass"
      },
      {
        "at": "2026-03-18T01:27:08+00:00",
        "step": "doctor",
        "status": "completed",
        "detail": "all checks passed"
      },
      {
        "at": "2026-03-18T01:27:11+00:00",
        "step": "provision-compose-environment",
        "status": "ready",
        "detail": ""
      },
      {
        "at": "2026-03-18T01:27:11+00:00",
        "step": "wait-ready",
        "status": "completed",
        "detail": "baseline urls ready (1)"
      },
      {
        "at": "2026-03-18T01:27:11+00:00",
        "step": "seed-environment",
        "status": "completed",
        "detail": "steps=1"
      },
      {
        "at": "2026-03-18T01:27:11+00:00",
        "step": "baseline-snapshot",
        "status": "completed",
        "detail": "urls=1"
      },
      {
        "at": "2026-03-18T01:27:11+00:00",
        "step": "controlled-attack-chain",
        "status": "completed",
        "detail": "steps=1"
      },
      {
        "at": "2026-03-18T01:27:11+00:00",
        "step": "collect-logs-and-evidence",
        "status": "completed",
        "detail": "container_logs=1"
      },
      {
        "at": "2026-03-18T01:27:12+00:00",
        "step": "cleanup-compose-environment",
        "status": "completed",
        "detail": "docker compose down completed"
      },
      {
        "at": "2026-03-18T01:27:12+00:00",
        "step": "update-registry-and-reports",
        "status": "completed",
        "detail": "gitea-gitea--CVE-2025-68940-20260318012708"
      }
    ],
    "success_evaluation": {
      "passed": true,
      "verification_status": "verified-real",
      "blocked_reason": null,
      "assertions": [
        {
          "name": "baseline-ok",
          "kind": "baseline-ok",
          "passed": true,
          "detail": "baseline URLs responded without 5xx or transport errors"
        },
        {
          "name": "runner-success",
          "kind": "runner-success",
          "passed": true,
          "detail": "server-side authorization recheck was bypassed"
        }
      ]
    },
    "historical_status": "verified-real",
    "latest_status": "verified-real",
    "started_at": "2026-03-18T01:27:08+00:00",
    "finished_at": "2026-03-18T01:27:12+00:00",
    "blocked_reason": null,
    "report_refs": {
      "bundle_dir": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2025-68940-20260318012708",
      "report_md": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2025-68940-20260318012708/report.md",
      "report_html": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2025-68940-20260318012708/report.html",
      "timeline": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2025-68940-20260318012708/timeline.mmd"
    },
    "dashboard_refs": {
      "report_html": "/runs/gitea-gitea--CVE-2025-68940-20260318012708/report.html",
      "report_md": "/runs/gitea-gitea--CVE-2025-68940-20260318012708/report.md",
      "timeline": "/runs/gitea-gitea--CVE-2025-68940-20260318012708/timeline.mmd",
      "bundle": "/runs/gitea-gitea--CVE-2025-68940-20260318012708/run.json"
    },
    "browser_links": [],
    "container_links": [
      "/runs/gitea-gitea--CVE-2025-68940-20260318012708/logs/docker/app.log"
    ],
    "request_links": [
      "/runs/gitea-gitea--CVE-2025-68940-20260318012708/logs/attack.json",
      "/runs/gitea-gitea--CVE-2025-68940-20260318012708/logs/baseline.json"
    ],
    "advisory_meta": {},
    "profile_meta": {
      "profile_id": "gitea-authz-bypass",
      "vuln_family": "authz-bypass",
      "provisioning_mode": "real",
      "destructive_risk": "low",
      "cleanup_policy": "destroy",
      "artifact_source": {
        "strategy": "local-minimal-fixture"
      },
      "success_criteria": [
        "Controlled guest request reaches the protected admin route inside the fixture."
      ],
      "seed_actions": [
        {
          "kind": "note",
          "message": "Seed low-privilege and admin boundary fixture state."
        }
      ],
      "attack_actions": [
        {
          "kind": "note",
          "message": "Runner verifies guest-to-admin bypass only inside fixture route."
        }
      ],
      "browser_assertions": {
        "required": false
      },
      "allowed_target_types": [
        "lab-local"
      ],
      "required_services": [
        "app"
      ]
    },
    "reasoning_lines": [
      "Seed low-privilege and admin boundary fixture state.",
      "Runner verifies guest-to-admin bypass only inside fixture route.",
      "Controlled guest request reaches the protected admin route inside the fixture."
    ],
    "progress": {
      "completed": 10,
      "skipped": 0,
      "failed": 0,
      "blocked": 0,
      "planned": 0,
      "other": 1
    },
    "artifact_groups": [
      {
        "key": "reports",
        "label": "\u62a5\u544a\u4e0e\u8fd0\u884c\u4ea7\u7269",
        "count": 4,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2025-68940-20260318012708/report.html",
            "label": "report.html",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2025-68940-20260318012708/report.md",
            "label": "report.md",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2025-68940-20260318012708/timeline.mmd",
            "label": "timeline.mmd",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2025-68940-20260318012708/run.json",
            "label": "run.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "compose",
        "label": "Compose \u7f16\u6392",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2025-68940-20260318012708/compose/compose.yaml",
            "label": "compose.yaml",
            "kind": "text"
          }
        ]
      },
      {
        "key": "baseline",
        "label": "\u57fa\u7ebf\u5feb\u7167",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2025-68940-20260318012708/logs/baseline.json",
            "label": "baseline.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "attack",
        "label": "\u653b\u51fb\u8f93\u51fa",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2025-68940-20260318012708/logs/attack.json",
            "label": "attack.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "container",
        "label": "\u5bb9\u5668\u65e5\u5fd7",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2025-68940-20260318012708/logs/docker/app.log",
            "label": "app.log",
            "kind": "text"
          }
        ]
      },
      {
        "key": "requests",
        "label": "\u8bf7\u6c42\u4e0e\u63a2\u6d4b\u65e5\u5fd7",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2025-68940-20260318012708/logs/attack.json",
            "label": "attack.json",
            "kind": "text"
          }
        ]
      }
    ]
  },
  {
    "run_id": "gitea-gitea--CVE-2019-1010261-20260318012624",
    "system_id": "gitea",
    "advisory_id": "gitea--CVE-2019-1010261",
    "repro_profile_id": "gitea-xss",
    "verification_status": "verified-real",
    "verification_mode": "real",
    "artifact_mode": "local-fixture",
    "target_env": "local-docker",
    "compose_services": [
      "app"
    ],
    "baseline_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/baseline.json"
    ],
    "attack_steps": [
      {
        "kind": "runner",
        "tool": "gitea.xss",
        "status": "completed",
        "status_code": 200,
        "result_path": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/attack.json"
      }
    ],
    "browser_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/assets/baseline.png",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/assets/baseline-dom.html",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/baseline-console.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/baseline-network.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/baseline-page.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/assets/proof.png",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/assets/proof-dom.html",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/proof-console.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/proof-network.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/proof-page.json"
    ],
    "browser_evidence": {
      "required": true,
      "present": true,
      "refs": [
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/assets/baseline.png",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/assets/baseline-dom.html",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/baseline-console.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/baseline-network.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/baseline-page.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/assets/proof.png",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/assets/proof-dom.html",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/proof-console.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/proof-network.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/proof-page.json"
      ],
      "baseline_refs": [
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/assets/baseline.png",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/assets/baseline-dom.html",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/baseline-console.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/baseline-network.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/baseline-page.json"
      ],
      "proof_refs": [
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/assets/proof.png",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/assets/proof-dom.html",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/proof-console.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/proof-network.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/proof-page.json"
      ],
      "baseline_title": "Gitea Stored XSS Fixture",
      "proof_title": "Gitea Stored XSS Fixture - proof",
      "error_kind": null,
      "reason": null
    },
    "container_log_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/docker/app.log"
    ],
    "request_log_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/attack.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/baseline.json"
    ],
    "compose_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/compose/compose.yaml"
    ],
    "timeline": [
      {
        "at": "2026-03-18T01:26:24+00:00",
        "step": "select-advisory",
        "status": "completed",
        "detail": "gitea--CVE-2019-1010261"
      },
      {
        "at": "2026-03-18T01:26:24+00:00",
        "step": "resolve-repro-profile",
        "status": "completed",
        "detail": "gitea-xss"
      },
      {
        "at": "2026-03-18T01:26:24+00:00",
        "step": "doctor",
        "status": "completed",
        "detail": "all checks passed"
      },
      {
        "at": "2026-03-18T01:26:27+00:00",
        "step": "provision-compose-environment",
        "status": "ready",
        "detail": ""
      },
      {
        "at": "2026-03-18T01:26:27+00:00",
        "step": "wait-ready",
        "status": "completed",
        "detail": "baseline urls ready (1)"
      },
      {
        "at": "2026-03-18T01:26:27+00:00",
        "step": "seed-environment",
        "status": "completed",
        "detail": "steps=1"
      },
      {
        "at": "2026-03-18T01:26:27+00:00",
        "step": "baseline-snapshot",
        "status": "completed",
        "detail": "urls=1"
      },
      {
        "at": "2026-03-18T01:26:28+00:00",
        "step": "browser-replay-before-attack",
        "status": "completed",
        "detail": ""
      },
      {
        "at": "2026-03-18T01:26:28+00:00",
        "step": "controlled-attack-chain",
        "status": "completed",
        "detail": "steps=1"
      },
      {
        "at": "2026-03-18T01:26:29+00:00",
        "step": "browser-replay-after-attack",
        "status": "completed",
        "detail": ""
      },
      {
        "at": "2026-03-18T01:26:29+00:00",
        "step": "collect-logs-and-evidence",
        "status": "completed",
        "detail": "container_logs=1"
      },
      {
        "at": "2026-03-18T01:26:30+00:00",
        "step": "cleanup-compose-environment",
        "status": "completed",
        "detail": "docker compose down completed"
      },
      {
        "at": "2026-03-18T01:26:30+00:00",
        "step": "update-registry-and-reports",
        "status": "completed",
        "detail": "gitea-gitea--CVE-2019-1010261-20260318012624"
      }
    ],
    "success_evaluation": {
      "passed": true,
      "verification_status": "verified-real",
      "blocked_reason": null,
      "assertions": [
        {
          "name": "baseline-ok",
          "kind": "baseline-ok",
          "passed": true,
          "detail": "baseline URLs responded without 5xx or transport errors"
        },
        {
          "name": "runner-success",
          "kind": "runner-success",
          "passed": true,
          "detail": "stored payload rendered inside the browser proof page"
        },
        {
          "name": "browser-present",
          "kind": "browser-present",
          "passed": true,
          "detail": "browser evidence captured"
        }
      ]
    },
    "historical_status": "verified-real",
    "latest_status": "verified-real",
    "started_at": "2026-03-18T01:26:24+00:00",
    "finished_at": "2026-03-18T01:26:30+00:00",
    "blocked_reason": null,
    "report_refs": {
      "bundle_dir": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624",
      "report_md": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/report.md",
      "report_html": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/report.html",
      "timeline": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2019-1010261-20260318012624/timeline.mmd"
    },
    "dashboard_refs": {
      "report_html": "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/report.html",
      "report_md": "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/report.md",
      "timeline": "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/timeline.mmd",
      "bundle": "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/run.json"
    },
    "browser_links": [
      "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/assets/baseline.png",
      "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/assets/baseline-dom.html",
      "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/baseline-console.json",
      "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/baseline-network.json",
      "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/baseline-page.json",
      "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/assets/proof.png",
      "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/assets/proof-dom.html",
      "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/proof-console.json",
      "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/proof-network.json",
      "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/proof-page.json"
    ],
    "container_links": [
      "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/docker/app.log"
    ],
    "request_links": [
      "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/attack.json",
      "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/baseline.json"
    ],
    "advisory_meta": {},
    "profile_meta": {
      "profile_id": "gitea-xss",
      "vuln_family": "xss",
      "provisioning_mode": "real",
      "destructive_risk": "low",
      "cleanup_policy": "destroy",
      "artifact_source": {
        "strategy": "local-minimal-fixture"
      },
      "success_criteria": [
        "Browser proof page renders the stored XSS marker after the controlled payload."
      ],
      "seed_actions": [
        {
          "kind": "note",
          "message": "Seed stored content page before browser proof capture."
        }
      ],
      "attack_actions": [
        {
          "kind": "note",
          "message": "Runner stores inert script payload and captures proof page."
        }
      ],
      "browser_assertions": {
        "required": true
      },
      "allowed_target_types": [
        "lab-local"
      ],
      "required_services": [
        "app"
      ]
    },
    "reasoning_lines": [
      "Seed stored content page before browser proof capture.",
      "Runner stores inert script payload and captures proof page.",
      "Browser proof page renders the stored XSS marker after the controlled payload."
    ],
    "progress": {
      "completed": 12,
      "skipped": 0,
      "failed": 0,
      "blocked": 0,
      "planned": 0,
      "other": 1
    },
    "artifact_groups": [
      {
        "key": "reports",
        "label": "\u62a5\u544a\u4e0e\u8fd0\u884c\u4ea7\u7269",
        "count": 4,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/report.html",
            "label": "report.html",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/report.md",
            "label": "report.md",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/timeline.mmd",
            "label": "timeline.mmd",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/run.json",
            "label": "run.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "compose",
        "label": "Compose \u7f16\u6392",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/compose/compose.yaml",
            "label": "compose.yaml",
            "kind": "text"
          }
        ]
      },
      {
        "key": "baseline",
        "label": "\u57fa\u7ebf\u5feb\u7167",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/baseline.json",
            "label": "baseline.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "attack",
        "label": "\u653b\u51fb\u8f93\u51fa",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/attack.json",
            "label": "attack.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "browser",
        "label": "\u6d4f\u89c8\u5668\u8bc1\u636e",
        "count": 10,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/assets/baseline.png",
            "label": "baseline.png",
            "kind": "image"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/assets/baseline-dom.html",
            "label": "baseline-dom.html",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/baseline-console.json",
            "label": "baseline-console.json",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/baseline-network.json",
            "label": "baseline-network.json",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/baseline-page.json",
            "label": "baseline-page.json",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/assets/proof.png",
            "label": "proof.png",
            "kind": "image"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/assets/proof-dom.html",
            "label": "proof-dom.html",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/proof-console.json",
            "label": "proof-console.json",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/proof-network.json",
            "label": "proof-network.json",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/proof-page.json",
            "label": "proof-page.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "container",
        "label": "\u5bb9\u5668\u65e5\u5fd7",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/docker/app.log",
            "label": "app.log",
            "kind": "text"
          }
        ]
      },
      {
        "key": "requests",
        "label": "\u8bf7\u6c42\u4e0e\u63a2\u6d4b\u65e5\u5fd7",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2019-1010261-20260318012624/logs/attack.json",
            "label": "attack.json",
            "kind": "text"
          }
        ]
      }
    ]
  },
  {
    "run_id": "gitea-gitea--CVE-2018-18926-20260318012526",
    "system_id": "gitea",
    "advisory_id": "gitea--CVE-2018-18926",
    "repro_profile_id": "gitea-proxy-boundary",
    "verification_status": "verified-real",
    "verification_mode": "real",
    "artifact_mode": "local-fixture",
    "target_env": "local-docker",
    "compose_services": [
      "app"
    ],
    "baseline_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/baseline.json"
    ],
    "attack_steps": [
      {
        "kind": "runner",
        "tool": "gitea.proxy-boundary",
        "status": "completed",
        "status_code": 200,
        "result_path": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/attack.json"
      }
    ],
    "browser_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/assets/baseline.png",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/assets/baseline-dom.html",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/baseline-console.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/baseline-network.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/baseline-page.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/assets/proof.png",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/assets/proof-dom.html",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/proof-console.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/proof-network.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/proof-page.json"
    ],
    "browser_evidence": {
      "required": true,
      "present": true,
      "refs": [
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/assets/baseline.png",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/assets/baseline-dom.html",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/baseline-console.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/baseline-network.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/baseline-page.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/assets/proof.png",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/assets/proof-dom.html",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/proof-console.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/proof-network.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/proof-page.json"
      ],
      "baseline_refs": [
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/assets/baseline.png",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/assets/baseline-dom.html",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/baseline-console.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/baseline-network.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/baseline-page.json"
      ],
      "proof_refs": [
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/assets/proof.png",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/assets/proof-dom.html",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/proof-console.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/proof-network.json",
        "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/proof-page.json"
      ],
      "baseline_title": "Gitea Proxy Boundary Fixture",
      "proof_title": "Gitea Proxy Boundary Fixture - proof",
      "error_kind": null,
      "reason": null
    },
    "container_log_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/docker/app.log"
    ],
    "request_log_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/attack.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/baseline.json"
    ],
    "compose_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/compose/compose.yaml"
    ],
    "timeline": [
      {
        "at": "2026-03-18T01:25:26+00:00",
        "step": "select-advisory",
        "status": "completed",
        "detail": "gitea--CVE-2018-18926"
      },
      {
        "at": "2026-03-18T01:25:26+00:00",
        "step": "resolve-repro-profile",
        "status": "completed",
        "detail": "gitea-proxy-boundary"
      },
      {
        "at": "2026-03-18T01:25:27+00:00",
        "step": "doctor",
        "status": "completed",
        "detail": "all checks passed"
      },
      {
        "at": "2026-03-18T01:25:41+00:00",
        "step": "provision-compose-environment",
        "status": "ready",
        "detail": ""
      },
      {
        "at": "2026-03-18T01:25:42+00:00",
        "step": "wait-ready",
        "status": "completed",
        "detail": "baseline urls ready (1)"
      },
      {
        "at": "2026-03-18T01:25:42+00:00",
        "step": "seed-environment",
        "status": "completed",
        "detail": "steps=1"
      },
      {
        "at": "2026-03-18T01:25:42+00:00",
        "step": "baseline-snapshot",
        "status": "completed",
        "detail": "urls=1"
      },
      {
        "at": "2026-03-18T01:25:42+00:00",
        "step": "browser-replay-before-attack",
        "status": "completed",
        "detail": ""
      },
      {
        "at": "2026-03-18T01:25:42+00:00",
        "step": "controlled-attack-chain",
        "status": "completed",
        "detail": "steps=1"
      },
      {
        "at": "2026-03-18T01:25:43+00:00",
        "step": "browser-replay-after-attack",
        "status": "completed",
        "detail": ""
      },
      {
        "at": "2026-03-18T01:25:43+00:00",
        "step": "collect-logs-and-evidence",
        "status": "completed",
        "detail": "container_logs=1"
      },
      {
        "at": "2026-03-18T01:25:45+00:00",
        "step": "cleanup-compose-environment",
        "status": "completed",
        "detail": "docker compose down completed"
      },
      {
        "at": "2026-03-18T01:25:45+00:00",
        "step": "update-registry-and-reports",
        "status": "completed",
        "detail": "gitea-gitea--CVE-2018-18926-20260318012526"
      }
    ],
    "success_evaluation": {
      "passed": true,
      "verification_status": "verified-real",
      "blocked_reason": null,
      "assertions": [
        {
          "name": "baseline-ok",
          "kind": "baseline-ok",
          "passed": true,
          "detail": "baseline URLs responded without 5xx or transport errors"
        },
        {
          "name": "runner-success",
          "kind": "runner-success",
          "passed": true,
          "detail": "trusted forwarded headers crossed the boundary"
        },
        {
          "name": "browser-present",
          "kind": "browser-present",
          "passed": true,
          "detail": "browser evidence captured"
        }
      ]
    },
    "historical_status": "verified-real",
    "latest_status": "verified-real",
    "started_at": "2026-03-18T01:25:26+00:00",
    "finished_at": "2026-03-18T01:25:45+00:00",
    "blocked_reason": null,
    "report_refs": {
      "bundle_dir": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526",
      "report_md": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/report.md",
      "report_html": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/report.html",
      "timeline": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2018-18926-20260318012526/timeline.mmd"
    },
    "dashboard_refs": {
      "report_html": "/runs/gitea-gitea--CVE-2018-18926-20260318012526/report.html",
      "report_md": "/runs/gitea-gitea--CVE-2018-18926-20260318012526/report.md",
      "timeline": "/runs/gitea-gitea--CVE-2018-18926-20260318012526/timeline.mmd",
      "bundle": "/runs/gitea-gitea--CVE-2018-18926-20260318012526/run.json"
    },
    "browser_links": [
      "/runs/gitea-gitea--CVE-2018-18926-20260318012526/assets/baseline.png",
      "/runs/gitea-gitea--CVE-2018-18926-20260318012526/assets/baseline-dom.html",
      "/runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/baseline-console.json",
      "/runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/baseline-network.json",
      "/runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/baseline-page.json",
      "/runs/gitea-gitea--CVE-2018-18926-20260318012526/assets/proof.png",
      "/runs/gitea-gitea--CVE-2018-18926-20260318012526/assets/proof-dom.html",
      "/runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/proof-console.json",
      "/runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/proof-network.json",
      "/runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/proof-page.json"
    ],
    "container_links": [
      "/runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/docker/app.log"
    ],
    "request_links": [
      "/runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/attack.json",
      "/runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/baseline.json"
    ],
    "advisory_meta": {},
    "profile_meta": {
      "profile_id": "gitea-proxy-boundary",
      "vuln_family": "proxy-boundary",
      "provisioning_mode": "real",
      "destructive_risk": "low",
      "cleanup_policy": "destroy",
      "artifact_source": {
        "strategy": "local-minimal-fixture"
      },
      "success_criteria": [
        "Local fixture proves trusted proxy headers cross the admin boundary."
      ],
      "seed_actions": [
        {
          "kind": "note",
          "message": "Seed forwarded-header boundary fixture with clean state."
        }
      ],
      "attack_actions": [
        {
          "kind": "note",
          "message": "Runner performs local forwarded-header trust proof only inside the fixture."
        }
      ],
      "browser_assertions": {
        "required": true
      },
      "allowed_target_types": [
        "lab-local"
      ],
      "required_services": [
        "app"
      ]
    },
    "reasoning_lines": [
      "Seed forwarded-header boundary fixture with clean state.",
      "Runner performs local forwarded-header trust proof only inside the fixture.",
      "Local fixture proves trusted proxy headers cross the admin boundary."
    ],
    "progress": {
      "completed": 12,
      "skipped": 0,
      "failed": 0,
      "blocked": 0,
      "planned": 0,
      "other": 1
    },
    "artifact_groups": [
      {
        "key": "reports",
        "label": "\u62a5\u544a\u4e0e\u8fd0\u884c\u4ea7\u7269",
        "count": 4,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2018-18926-20260318012526/report.html",
            "label": "report.html",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2018-18926-20260318012526/report.md",
            "label": "report.md",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2018-18926-20260318012526/timeline.mmd",
            "label": "timeline.mmd",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2018-18926-20260318012526/run.json",
            "label": "run.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "compose",
        "label": "Compose \u7f16\u6392",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2018-18926-20260318012526/compose/compose.yaml",
            "label": "compose.yaml",
            "kind": "text"
          }
        ]
      },
      {
        "key": "baseline",
        "label": "\u57fa\u7ebf\u5feb\u7167",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/baseline.json",
            "label": "baseline.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "attack",
        "label": "\u653b\u51fb\u8f93\u51fa",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/attack.json",
            "label": "attack.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "browser",
        "label": "\u6d4f\u89c8\u5668\u8bc1\u636e",
        "count": 10,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2018-18926-20260318012526/assets/baseline.png",
            "label": "baseline.png",
            "kind": "image"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2018-18926-20260318012526/assets/baseline-dom.html",
            "label": "baseline-dom.html",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/baseline-console.json",
            "label": "baseline-console.json",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/baseline-network.json",
            "label": "baseline-network.json",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/baseline-page.json",
            "label": "baseline-page.json",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2018-18926-20260318012526/assets/proof.png",
            "label": "proof.png",
            "kind": "image"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2018-18926-20260318012526/assets/proof-dom.html",
            "label": "proof-dom.html",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/proof-console.json",
            "label": "proof-console.json",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/proof-network.json",
            "label": "proof-network.json",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/proof-page.json",
            "label": "proof-page.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "container",
        "label": "\u5bb9\u5668\u65e5\u5fd7",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/docker/app.log",
            "label": "app.log",
            "kind": "text"
          }
        ]
      },
      {
        "key": "requests",
        "label": "\u8bf7\u6c42\u4e0e\u63a2\u6d4b\u65e5\u5fd7",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2018-18926-20260318012526/logs/attack.json",
            "label": "attack.json",
            "kind": "text"
          }
        ]
      }
    ]
  },
  {
    "run_id": "gitea-livecheck-20260316",
    "system_id": "gitea",
    "advisory_id": "gitea--CVE-2025-68939",
    "repro_profile_id": "file-upload-generic",
    "verification_status": "blocked-artifact",
    "verification_mode": "real",
    "artifact_mode": "official-image",
    "target_env": "local-docker",
    "compose_services": [
      "app"
    ],
    "baseline_refs": [],
    "attack_steps": [],
    "browser_refs": [],
    "browser_evidence": {
      "required": true,
      "present": false,
      "refs": [],
      "baseline_refs": [],
      "proof_refs": [],
      "baseline_title": null,
      "proof_title": null
    },
    "container_log_refs": [],
    "request_log_refs": [],
    "compose_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-livecheck-20260316/compose/compose.yaml"
    ],
    "timeline": [
      {
        "at": "2026-03-17T07:02:55+00:00",
        "step": "select-advisory",
        "status": "completed",
        "detail": "gitea--CVE-2025-68939"
      },
      {
        "at": "2026-03-17T07:02:55+00:00",
        "step": "resolve-repro-profile",
        "status": "completed",
        "detail": "file-upload-generic"
      },
      {
        "at": "2026-03-17T07:02:56+00:00",
        "step": "provision-compose-environment",
        "status": "blocked-artifact",
        "detail": "unable to get image 'gitea/gitea:1.22.6': Cannot connect to the Docker daemon at unix:///Users/x/.docker/run/docker.sock. Is the docker daemon running?"
      },
      {
        "at": "2026-03-17T07:02:56+00:00",
        "step": "baseline-snapshot",
        "status": "skipped",
        "detail": "no baseline urls or provisioning blocked"
      },
      {
        "at": "2026-03-17T07:02:56+00:00",
        "step": "browser-replay-before-attack",
        "status": "skipped",
        "detail": "baseline browser capture unavailable"
      },
      {
        "at": "2026-03-17T07:02:56+00:00",
        "step": "controlled-attack-chain",
        "status": "skipped",
        "detail": "provisioning blocked"
      },
      {
        "at": "2026-03-17T07:02:56+00:00",
        "step": "browser-replay-after-attack",
        "status": "skipped",
        "detail": "proof browser capture unavailable"
      },
      {
        "at": "2026-03-17T07:02:56+00:00",
        "step": "collect-logs-and-evidence",
        "status": "skipped",
        "detail": "container_logs=0"
      },
      {
        "at": "2026-03-17T07:02:56+00:00",
        "step": "update-registry-and-reports",
        "status": "completed",
        "detail": "gitea-livecheck-20260316"
      }
    ],
    "started_at": "2026-03-17T07:02:55+00:00",
    "finished_at": "2026-03-17T07:02:56+00:00",
    "blocked_reason": "unable to get image 'gitea/gitea:1.22.6': Cannot connect to the Docker daemon at unix:///Users/x/.docker/run/docker.sock. Is the docker daemon running?",
    "report_refs": {
      "bundle_dir": "/Users/x/websafe/06-case-studies/generated-runs/gitea-livecheck-20260316",
      "report_md": "/Users/x/websafe/06-case-studies/generated-runs/gitea-livecheck-20260316/report.md",
      "report_html": "/Users/x/websafe/06-case-studies/generated-runs/gitea-livecheck-20260316/report.html",
      "timeline": "/Users/x/websafe/06-case-studies/generated-runs/gitea-livecheck-20260316/timeline.mmd"
    },
    "dashboard_refs": {
      "report_html": "/runs/gitea-livecheck-20260316/report.html",
      "report_md": "/runs/gitea-livecheck-20260316/report.md",
      "timeline": "/runs/gitea-livecheck-20260316/timeline.mmd",
      "bundle": "/runs/gitea-livecheck-20260316/run.json"
    },
    "browser_links": [],
    "container_links": [],
    "request_links": [],
    "advisory_meta": {},
    "profile_meta": {
      "profile_id": "file-upload-generic",
      "vuln_family": "file-upload",
      "provisioning_mode": "real",
      "destructive_risk": "medium",
      "cleanup_policy": "destroy",
      "artifact_source": {
        "strategy": "official-image-or-source"
      },
      "success_criteria": [
        "Upload acceptance or bypass path is demonstrated with reversible test artifacts."
      ],
      "seed_actions": [
        {
          "kind": "note",
          "message": "Use inert marker files and non-executable payloads by default."
        }
      ],
      "attack_actions": [
        {
          "kind": "note",
          "message": "Validate extension, storage path, and preview behavior using inert files."
        }
      ],
      "browser_assertions": {
        "required": true
      },
      "allowed_target_types": [
        "lab-local",
        "lab-public",
        "authorized-third-party"
      ],
      "required_services": [
        "app"
      ]
    },
    "reasoning_lines": [
      "Use inert marker files and non-executable payloads by default.",
      "Validate extension, storage path, and preview behavior using inert files.",
      "Upload acceptance or bypass path is demonstrated with reversible test artifacts."
    ],
    "progress": {
      "completed": 3,
      "skipped": 5,
      "failed": 0,
      "blocked": 1,
      "planned": 0,
      "other": 0
    },
    "artifact_groups": [
      {
        "key": "reports",
        "label": "\u62a5\u544a\u4e0e\u8fd0\u884c\u4ea7\u7269",
        "count": 4,
        "items": [
          {
            "href": "/runs/gitea-livecheck-20260316/report.html",
            "label": "report.html",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-livecheck-20260316/report.md",
            "label": "report.md",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-livecheck-20260316/timeline.mmd",
            "label": "timeline.mmd",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-livecheck-20260316/run.json",
            "label": "run.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "compose",
        "label": "Compose \u7f16\u6392",
        "count": 1,
        "items": [
          {
            "href": "/runs/gitea-livecheck-20260316/compose/compose.yaml",
            "label": "compose.yaml",
            "kind": "text"
          }
        ]
      }
    ]
  },
  {
    "run_id": "gitea-gitea--CVE-2025-68939-20260317063330",
    "system_id": "gitea",
    "advisory_id": "gitea--CVE-2025-68939",
    "repro_profile_id": "file-upload-generic",
    "verification_status": "blocked-artifact",
    "verification_mode": "real",
    "artifact_mode": "official-image",
    "target_env": "local-docker",
    "compose_services": [
      "app"
    ],
    "baseline_refs": [],
    "attack_steps": [],
    "browser_refs": [],
    "container_log_refs": [],
    "request_log_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2025-68939-20260317063330/logs/attack.json",
      "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2025-68939-20260317063330/logs/baseline.json"
    ],
    "timeline": [],
    "started_at": "2026-03-17T06:33:30+00:00",
    "finished_at": "2026-03-17T06:33:30+00:00",
    "blocked_reason": "unable to get image 'gitea/gitea:1.22.6': Cannot connect to the Docker daemon at unix:///Users/x/.docker/run/docker.sock. Is the docker daemon running?",
    "report_refs": {
      "bundle_dir": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2025-68939-20260317063330",
      "report_md": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2025-68939-20260317063330/report.md",
      "report_html": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2025-68939-20260317063330/report.html",
      "timeline": "/Users/x/websafe/06-case-studies/generated-runs/gitea-gitea--CVE-2025-68939-20260317063330/timeline.mmd"
    },
    "dashboard_refs": {
      "report_html": "/runs/gitea-gitea--CVE-2025-68939-20260317063330/report.html",
      "report_md": "/runs/gitea-gitea--CVE-2025-68939-20260317063330/report.md",
      "timeline": "/runs/gitea-gitea--CVE-2025-68939-20260317063330/timeline.mmd",
      "bundle": "/runs/gitea-gitea--CVE-2025-68939-20260317063330/run.json"
    },
    "browser_evidence": {
      "required": true,
      "present": false,
      "refs": []
    },
    "browser_links": [],
    "container_links": [],
    "request_links": [
      "/runs/gitea-gitea--CVE-2025-68939-20260317063330/logs/attack.json",
      "/runs/gitea-gitea--CVE-2025-68939-20260317063330/logs/baseline.json"
    ],
    "advisory_meta": {},
    "profile_meta": {
      "profile_id": "file-upload-generic",
      "vuln_family": "file-upload",
      "provisioning_mode": "real",
      "destructive_risk": "medium",
      "cleanup_policy": "destroy",
      "artifact_source": {
        "strategy": "official-image-or-source"
      },
      "success_criteria": [
        "Upload acceptance or bypass path is demonstrated with reversible test artifacts."
      ],
      "seed_actions": [
        {
          "kind": "note",
          "message": "Use inert marker files and non-executable payloads by default."
        }
      ],
      "attack_actions": [
        {
          "kind": "note",
          "message": "Validate extension, storage path, and preview behavior using inert files."
        }
      ],
      "browser_assertions": {
        "required": true
      },
      "allowed_target_types": [
        "lab-local",
        "lab-public",
        "authorized-third-party"
      ],
      "required_services": [
        "app"
      ]
    },
    "reasoning_lines": [
      "Use inert marker files and non-executable payloads by default.",
      "Validate extension, storage path, and preview behavior using inert files.",
      "Upload acceptance or bypass path is demonstrated with reversible test artifacts."
    ],
    "progress": {
      "completed": 0,
      "skipped": 0,
      "failed": 0,
      "blocked": 0,
      "planned": 0,
      "other": 0
    },
    "artifact_groups": [
      {
        "key": "reports",
        "label": "\u62a5\u544a\u4e0e\u8fd0\u884c\u4ea7\u7269",
        "count": 4,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2025-68939-20260317063330/report.html",
            "label": "report.html",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2025-68939-20260317063330/report.md",
            "label": "report.md",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2025-68939-20260317063330/timeline.mmd",
            "label": "timeline.mmd",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2025-68939-20260317063330/run.json",
            "label": "run.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "requests",
        "label": "\u8bf7\u6c42\u4e0e\u63a2\u6d4b\u65e5\u5fd7",
        "count": 2,
        "items": [
          {
            "href": "/runs/gitea-gitea--CVE-2025-68939-20260317063330/logs/attack.json",
            "label": "attack.json",
            "kind": "text"
          },
          {
            "href": "/runs/gitea-gitea--CVE-2025-68939-20260317063330/logs/baseline.json",
            "label": "baseline.json",
            "kind": "text"
          }
        ]
      }
    ]
  },
  {
    "run_id": "nextjs-nextjs--CVE-2025-29927-20260317063047",
    "system_id": "nextjs",
    "advisory_id": "nextjs--CVE-2025-29927",
    "repro_profile_id": "authz-bypass-generic",
    "verification_status": "triage-manual",
    "verification_mode": "real",
    "artifact_mode": "official-source",
    "target_env": "local-docker",
    "compose_services": [
      "app"
    ],
    "baseline_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2025-29927-20260317063047/logs/baseline.json"
    ],
    "attack_steps": [
      {
        "kind": "note",
        "tool": null,
        "args": [],
        "status": "planned"
      }
    ],
    "browser_refs": [],
    "container_log_refs": [],
    "request_log_refs": [
      "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2025-29927-20260317063047/logs/attack.json",
      "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2025-29927-20260317063047/logs/baseline.json"
    ],
    "timeline": [],
    "started_at": "2026-03-17T06:30:47+00:00",
    "finished_at": "2026-03-17T06:30:47+00:00",
    "blocked_reason": "dry-run only",
    "report_refs": {
      "bundle_dir": "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2025-29927-20260317063047",
      "report_md": "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2025-29927-20260317063047/report.md",
      "report_html": "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2025-29927-20260317063047/report.html",
      "timeline": "/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2025-29927-20260317063047/timeline.mmd"
    },
    "dashboard_refs": {
      "report_html": "/runs/nextjs-nextjs--CVE-2025-29927-20260317063047/report.html",
      "report_md": "/runs/nextjs-nextjs--CVE-2025-29927-20260317063047/report.md",
      "timeline": "/runs/nextjs-nextjs--CVE-2025-29927-20260317063047/timeline.mmd",
      "bundle": "/runs/nextjs-nextjs--CVE-2025-29927-20260317063047/run.json"
    },
    "browser_evidence": {
      "required": false,
      "present": false,
      "refs": []
    },
    "browser_links": [],
    "container_links": [],
    "request_links": [
      "/runs/nextjs-nextjs--CVE-2025-29927-20260317063047/logs/attack.json",
      "/runs/nextjs-nextjs--CVE-2025-29927-20260317063047/logs/baseline.json"
    ],
    "advisory_meta": {},
    "profile_meta": {
      "profile_id": "authz-bypass-generic",
      "vuln_family": "authz-bypass",
      "provisioning_mode": "real",
      "destructive_risk": "medium",
      "cleanup_policy": "destroy",
      "artifact_source": {
        "strategy": "official-image-or-source"
      },
      "success_criteria": [
        "Protected route or action is evaluated with controlled credentials and logged."
      ],
      "seed_actions": [
        {
          "kind": "note",
          "message": "Create low-privilege and admin test users for server-side recheck validation."
        }
      ],
      "attack_actions": [
        {
          "kind": "note",
          "message": "Use minimal authorization bypass probes defined by case-specific runner or manual session tooling."
        }
      ],
      "browser_assertions": {
        "required": false
      },
      "allowed_target_types": [
        "lab-local",
        "lab-public",
        "authorized-third-party"
      ],
      "required_services": [
        "app"
      ]
    },
    "reasoning_lines": [
      "Create low-privilege and admin test users for server-side recheck validation.",
      "Use minimal authorization bypass probes defined by case-specific runner or manual session tooling.",
      "Protected route or action is evaluated with controlled credentials and logged."
    ],
    "progress": {
      "completed": 0,
      "skipped": 0,
      "failed": 0,
      "blocked": 0,
      "planned": 0,
      "other": 0
    },
    "artifact_groups": [
      {
        "key": "reports",
        "label": "\u62a5\u544a\u4e0e\u8fd0\u884c\u4ea7\u7269",
        "count": 4,
        "items": [
          {
            "href": "/runs/nextjs-nextjs--CVE-2025-29927-20260317063047/report.html",
            "label": "report.html",
            "kind": "text"
          },
          {
            "href": "/runs/nextjs-nextjs--CVE-2025-29927-20260317063047/report.md",
            "label": "report.md",
            "kind": "text"
          },
          {
            "href": "/runs/nextjs-nextjs--CVE-2025-29927-20260317063047/timeline.mmd",
            "label": "timeline.mmd",
            "kind": "text"
          },
          {
            "href": "/runs/nextjs-nextjs--CVE-2025-29927-20260317063047/run.json",
            "label": "run.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "baseline",
        "label": "\u57fa\u7ebf\u5feb\u7167",
        "count": 1,
        "items": [
          {
            "href": "/runs/nextjs-nextjs--CVE-2025-29927-20260317063047/logs/baseline.json",
            "label": "baseline.json",
            "kind": "text"
          }
        ]
      },
      {
        "key": "requests",
        "label": "\u8bf7\u6c42\u4e0e\u63a2\u6d4b\u65e5\u5fd7",
        "count": 1,
        "items": [
          {
            "href": "/runs/nextjs-nextjs--CVE-2025-29927-20260317063047/logs/attack.json",
            "label": "attack.json",
            "kind": "text"
          }
        ]
      }
    ]
  }
]