Report a critical finding whose PoC reproduces from a clean environment via a repeatable script and a short report naming the affected component, what the attacker gains, and the fix (Re-run the PoC from a clean environment every turn - it reproduces exactly, or it isn't a finding); Nothing out of scope; read the program policy first and reproduce only on assets you own; touch only notes/**, pocs/**; or the PoC reproduces from a clean environment and the report is written or scope is exhausted with no critical candidate left or three turns pass with no new lead