{
  "candidates": [
    {
      "difference": "newer release-line implementation of the same real HTTP route and protected_media sink",
      "id": "C1-newer-2x-release-line-sibling",
      "payload": "plain traversal plus Referer /login",
      "runtime_tested": true
    },
    {
      "difference": "alternate encoded data path probing post-fix decoding assumptions",
      "id": "C2-double-percent-encoded-traversal",
      "payload": "double-percent encoded dot segments",
      "runtime_tested": true
    },
    {
      "difference": "public-prefix plus dot-segment normalization probes authorization/containment ordering",
      "id": "C3-public-prefix-normalization",
      "payload": "base/icon/../../private canary without credentials",
      "runtime_tested": true
    }
  ],
  "inspection": {
    "fixed_1_6_0": {
      "commit": "b3bd29d15819cbece45c58e6268ddd0614e387d6",
      "protected_media_present": true,
      "referer_authorization_present": false,
      "safe_join_present": true,
      "unsafe_join_present": false
    },
    "latest_v1": {
      "commit": "11c4e3a2596c58f2381bda4c6bbc319a4430b097",
      "protected_media_present": true,
      "referer_authorization_present": false,
      "safe_join_present": true,
      "unsafe_join_present": false
    },
    "latest_v2": {
      "commit": "a971ff98662904f798819415203ccb26bc4b0db3",
      "protected_media_present": true,
      "referer_authorization_present": false,
      "safe_join_present": true,
      "unsafe_join_present": false
    },
    "newer_release_2_1_0": {
      "commit": "b8cbf0af11d105e6e8c3708c3156322248f93e77",
      "protected_media_present": true,
      "referer_authorization_present": true,
      "safe_join_present": false,
      "unsafe_join_present": true
    },
    "submitted_1_5_0": {
      "commit": "61bd5173220d19925ad8220db9152a75c881ea73",
      "protected_media_present": true,
      "referer_authorization_present": true,
      "safe_join_present": false,
      "unsafe_join_present": true
    }
  },
  "schema_version": 1
}