Read this first: what belongs here, and what does not

This is the place for the conversation around the work — the question you would otherwise ask three people in a DM, the technique you are not sure generalises, the scope dispute you want a second opinion on.

Two rules, and they are the same rule.

• Do not post an unfixed vulnerability, or enough detail to reconstruct one. If it is still live it belongs in a report, not here.
• Do not post anything a program's disclosure policy has not released. The policy is machinery on this platform, not prose — see the write-up gate on /learn.

Everything else is fair game: methodology, tooling, dead ends, the bug you found six months ago that is long since patched.

If you are unsure whether something is publishable yet, it is not. Ask in this topic and we will tell you.