Cloudflare splits vulnerability hunting into six stages: an open audit skill where hunters, verifiers and records stay separate
Synopsis
Cloudflare has published a coding-agent skill that runs a security audit in six phases: reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification and target-neutral reporting. It is the single-repo starting point from which Cloudflare's vulnerability discovery harness evolved, requires that the agent checking a finding is never the one that found it, and sorts results into confirmed, needs-validation and rejected records. Repeated runs against the same repository are additive, using prior ledgers to target gaps and revalidate changed source.
Interpretation
A security audit is no longer a single agent's one-shot verdict but six ordered phases, each leaving a record that can be checked. Earlier practice did not separate reconnaissance, hunting, validation and reporting, nor write coverage as a ledger that can be audited. Reconnaissance maps architecture, trust boundaries, input surfaces and deterministic coverage into an architecture document and a coverage ledger, and hunters are then assigned from ledger units.
Every unique candidate goes to a fresh verifier that tries to disprove it, rather than being confirmed by the agent that found it. When one agent both finds and checks, confirmation and self-review are mixed together. A confirmed record needs a complete source trace and a bounded observed result, a needs-validation record holds one exact unresolved fact with no severity, and a rejected record marks a disproved candidate.
Reports are derived from verified records and the coverage ledger rather than written as a separate narrative. Reports previously had no enforced correspondence to the underlying records. The parent runs the coverage-ledger validator after the ledger is created and after each later update, and runs the findings validator in phase four and after every phase-five replacement.
Perspective
The workflow targets a coding agent working in a target codebase, requiring a model that supports tool use and parallel sub-agents, plus Node.js for the zero-dependency validators. Running target-controlled builds, tests, browsers, emulators, fuzzers and fixtures requires an OS-enforced sandbox that disables external networking, uses a sanitized allowlisted environment, enforces resource limits and permits writes only to assigned scratch paths; without these controls the workflow keeps the lead as needs-validation instead of executing target code. Direct codebase audit or pen-test requests use full audit mode, while security questions and focused vulnerability work use guidance mode unless report artifacts are requested.
The source only says the skill is the single-repo starting point before Cloudflare's vulnerability discovery harness evolved, and gives no detail on that harness's later stages. The workflow confirms only established boundary failures; a source-grounded but blocked lead stays needs-validation with its exact unresolved fact, and defense-in-depth gaps are not vulnerabilities. Severity requires impact, assessed as likelihood times impact rather than deviation from a checklist.