(Advanced Analysis)
Begin with the program policy and asset list. Map only the permitted attack surface, identify likely entry points, and prioritize checks that fit the published scope and testing limits.
Validate suspected issues with the least intrusive proof needed to explain impact. Avoid accessing or retaining sensitive data, follow program rules, and submit a concise report with reproduction steps and remediation context.