{"repro_id":"REPRO-2026-00296","version":6,"title":"Reported Horilla protected_media Referer authentication bypass","repro_type":"security","status":"published","severity":"high","description":"# Pruva Ticket Brief: Horilla Referer Authorization Bypass","root_cause":"## Summary\nHorilla HRMS tag 1.5.0 exposes a protected media authorization bypass in the real Django `/media/<path>` route. The vulnerable `protected_media()` view treats the path portion of the unauthenticated request's `Referer` header as proof that the media request originated from a public page. A remote unauthenticated attacker can therefore request a nonpublic file under `MEDIA_ROOT` and change only `Referer` from absent to `http://attacker.invalid/login`; Horilla 1.5.0 then returns the exact private file body. Horilla 1.6.0 removes this Referer-derived authorization decision and denies the same unauthenticated request.\n\n## Impact\n- Package/component affected: Horilla HRMS, `base.views.protected_media()` served through the real `/media/<path>` HTTP endpoint.\n- Affected version reproduced: tag `1.5.0`, commit `61bd5173220d19925ad8220db9152a75c881ea73`.\n- Fixed version verified: tag `1.6.0`, commit `b3bd29d15819cbece45c58e6268ddd0614e387d6`; source fix commit `b6eaec1386d8b8741a42fe7c78f318f073375791` is an ancestor of the fixed tag.\n- Risk level and consequences: high severity authorization bypass. An unauthenticated attacker who knows or can guess a private in-root media path can read that file without a cookie, session, bearer token, JWT, or any application credential. This run demonstrated unauthorized read of a randomly generated private canary under `MEDIA_ROOT` and did not demonstrate traversal, account takeover, session forgery, or code execution.\n\n## Impact Parity\n- Disclosed/claimed maximum impact: `authz_bypass` / unauthorized read of an exact nonpublic in-root media file via attacker-controlled `Referer` on the real Horilla `/media/<path>` route.\n- Reproduced impact from this run: full production-path `authz_bypass`. Horilla 1.5.0 denied the private canary with no `Referer` but returned HTTP 200 and the exact canary body when only `Referer: http://attacker.invalid/login` was added. Horilla 1.6.0 denied both requests while still serving a generated public liveness asset.\n- Parity: `full`.\n- Not demonstrated: path traversal, broader arbitrary file read outside `MEDIA_ROOT`, authenticated privilege changes, account takeover, session forgery, denial of service, or code execution.\n\n## Root Cause\nIn Horilla 1.5.0, `protected_media(request, path)` computes:\n\n```python\nreferer_path = urlparse(request.META.get(\"HTTP_REFERER\", \"\")).path\n```\n\nand then skips the authentication/JWT check when `referer_path` is one of several public pages such as `/login`. Because `Referer` is fully controlled by the HTTP client and is not an authentication boundary, an unauthenticated attacker can set a cross-origin value whose path is `/login`. The view then falls through to:\n\n```python\nreturn FileResponse(open(media_path, \"rb\"))\n```\n\nfor any existing media path not under the small exempted folder list. The source evidence in `bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/source/protected_media_hunks.log` shows this vulnerable logic in tag 1.5.0 and the fixed 1.6.0 logic. The fixed version removes public-page `Referer` authorization and instead permits only explicit public media path prefixes, uses `safe_join(settings.MEDIA_ROOT, path)`, and requires an authenticated user or valid JWT for all nonpublic media paths. The known fix commit is `b6eaec1386d8b8741a42fe7c78f318f073375791`.\n\n## Reproduction Steps\n1. Run `bundle/repro/reproduction_steps.sh` from any directory, optionally with `PRUVA_ROOT=/path/to/bundle`.\n2. The script reads `bundle/project_cache_context.json`, reuses or creates `/pruva/project-cache/repo`, verifies the vulnerable and fixed tag commits, installs each tag's own `requirements.txt` into isolated dependency directories, prepares migrated SQLite runtime templates, starts real Horilla Django `manage.py runserver` containers, and sends attacker-process `curl --path-as-is` requests to the real `/media/<path>` route.\n3. For each of two clean attempts per role, the script creates a new private canary under a nonpublic `MEDIA_ROOT/private-data/<run>/...` path and a public liveness canary under `MEDIA_ROOT/base/icon/...`. It records requests, responses, curl traces, container logs, source identities, and modified-file inventories.\n4. Expected evidence: vulnerable attempts show public liveness `200`, baseline private request with no `Referer` `302` denied with no canary in the body, and spoofed `Referer: http://attacker.invalid/login` `200` with response body equal to the private canary. Fixed attempts show public liveness `200` while both baseline and spoofed private requests return `302` and do not contain the canary.\n\n## Evidence\n- Main reproduction script: `bundle/repro/reproduction_steps.sh`.\n- Latest successful runtime manifest: `bundle/repro/runtime_manifest.json`.\n- Latest structured verdict: `bundle/repro/validation_verdict.json`.\n- Latest complete successful proof directory: `bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/`.\n- Matrix summary: `bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/matrix_summary.json` with `\"all_oracles_passed\": true`.\n- Source comparison: `bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/source/protected_media_hunks.log`.\n- Per-attempt request/response artifacts include:\n  - Vulnerable attempt 1 request pair: `attempts/vuln_1/baseline_no_referer_request.txt` and `attempts/vuln_1/trigger_spoofed_referer_request.txt`.\n  - Vulnerable attempt 1 body evidence: `attempts/vuln_1/private_canary.txt` and `attempts/vuln_1/trigger_spoofed_referer_response_body.bin` match exactly.\n  - Fixed attempt controls: `attempts/fixed_1/attempt_result.json` and `attempts/fixed_2/attempt_result.json` show both private requests denied and the public liveness route working.\n- Key latest matrix results:\n\n```json\n{\n  \"all_oracles_passed\": true,\n  \"attempt_results\": [\n    {\"role\": \"fixed\", \"attempt\": 1, \"public_status\": \"200\", \"baseline_status\": \"302\", \"trigger_status\": \"302\", \"oracle_passed\": true},\n    {\"role\": \"fixed\", \"attempt\": 2, \"public_status\": \"200\", \"baseline_status\": \"302\", \"trigger_status\": \"302\", \"oracle_passed\": true},\n    {\"role\": \"vuln\", \"attempt\": 1, \"public_status\": \"200\", \"baseline_status\": \"302\", \"trigger_status\": \"200\", \"oracle_passed\": true},\n    {\"role\": \"vuln\", \"attempt\": 2, \"public_status\": \"200\", \"baseline_status\": \"302\", \"trigger_status\": \"200\", \"oracle_passed\": true}\n  ]\n}\n```\n\n- The final script revision was executed successfully twice consecutively. The latest run completed at `2026-07-22T06:00:10Z` and the prior successful run completed at `2026-07-22T05:56:08Z`.\n\n## Recommendations / Next Steps\n- Upgrade Horilla deployments to version 1.6.0 or later, or apply fix commit `b6eaec1386d8b8741a42fe7c78f318f073375791` if maintaining a downstream branch.\n- Do not use `Referer`, `Origin`, or other client-controlled metadata as an authorization decision for protected media.\n- Keep a strict allowlist of genuinely public media prefixes and require a real authenticated user/session or valid token for every other media path.\n- Retain path containment checks such as Django `safe_join(settings.MEDIA_ROOT, path)` and verify that only regular files under `MEDIA_ROOT` can be opened.\n- Add regression tests at the real HTTP route level: absent `Referer`, cross-origin `/login` `Referer`, same-origin public pages, authenticated access, JWT access, and public-prefix liveness should all be covered.\n\n## Additional Notes\n- Idempotency confirmation: `bundle/repro/reproduction_steps.sh` passed two consecutive clean runs. Each run creates fresh random private and public canaries and clean per-attempt SQLite databases.\n- Runtime accommodations: to start the tagged application in this clean environment, the script installs each tag's dependencies and prepares SQLite migrations using `manage.py makemigrations` for the Horilla project apps before `migrate --run-syncdb`. It records modified-file inventories. It does not modify `base/views.py`, `base/urls.py`, routing, middleware, authentication logic, or file-open behavior.\n- The attacker requests are made by `curl` from outside the Horilla Django process, do not follow redirects, and explicitly record that no cookie or authorization header is sent.\n","ghsa_id":"GHSA-9WJX-4J4R-FF8W","source_url":"https://github.com/horilla/horilla-hr","package":{"name":"horilla/horilla-hr","ecosystem":"github"},"reproduced_at":"2026-07-26T17:01:34.254587+00:00","duration_secs":4629.0,"tool_calls":276,"handoffs":2,"total_cost_usd":16.03518600000001,"agent_costs":{"claim_matcher":0.037695,"judge":0.754256,"repro":10.881317000000005,"support":0.287692,"vuln_variant":4.074225999999999},"cost_breakdown":{"claim_matcher":{"gpt-5.5-2026-04-23":0.037695},"judge":{"gpt-5.5":0.754256},"repro":{"gpt-5.5":10.881317000000005},"support":{"gpt-5.5":0.287692},"vuln_variant":{"gpt-5.5":4.074225999999999}},"quality":{"confidence":"high","idempotent_verified":false,"community_verifications":0},"evidence":{"workflow":{"profile":"known_vulnerability","schema_version":2,"stages":["support","claim_contract","repro","judge","vuln_variant"]}},"environment":{"sandbox_image":"ghcr.io/n3mes1s/pruva-sandbox@sha256:8096b2518d6022e13d68f885c3b8ded6b4fe607098b1a1ccbfb99abc004d1dc1"},"published_at":"2026-07-26T17:01:36.709143+00:00","retracted":false,"artifacts":[{"path":"bundle/repro/reproduction_steps.sh","filename":"reproduction_steps.sh","size":27226,"category":"reproduction_script"},{"path":"bundle/repro/rca_report.md","filename":"rca_report.md","size":8221,"category":"analysis"},{"path":"bundle/vuln_variant/reproduction_steps.sh","filename":"reproduction_steps.sh","size":26793,"category":"reproduction_script"},{"path":"bundle/vuln_variant/rca_report.md","filename":"rca_report.md","size":11151,"category":"analysis"},{"path":"bundle/vuln_variant/root_cause_equivalence.json","filename":"root_cause_equivalence.json","size":2468,"category":"other"},{"path":"bundle/logs/vuln_variant/latest_version.txt","filename":"latest_version.txt","size":202,"category":"other"},{"path":"bundle/logs/vuln_variant/patch_and_security_scope.log","filename":"patch_and_security_scope.log","size":10905,"category":"log"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/public_liveness_curl_stderr.txt","filename":"public_liveness_curl_stderr.txt","size":0,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/direct_private_spoofed_referer_request.txt","filename":"direct_private_spoofed_referer_request.txt","size":244,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/direct_private_spoofed_referer_response_body.bin","filename":"direct_private_spoofed_referer_response_body.bin","size":0,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/direct_private_spoofed_referer_response_headers.txt","filename":"direct_private_spoofed_referer_response_headers.txt","size":748,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/direct_private_spoofed_referer_curl_stderr.txt","filename":"direct_private_spoofed_referer_curl_stderr.txt","size":0,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/direct_private_spoofed_referer_curl_trace.txt","filename":"direct_private_spoofed_referer_curl_trace.txt","size":1676,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/direct_private_spoofed_referer_meta.json","filename":"direct_private_spoofed_referer_meta.json","size":944,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/direct_private_spoofed_referer_request.txt","filename":"direct_private_spoofed_referer_request.txt","size":243,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/direct_private_spoofed_referer_response_body.bin","filename":"direct_private_spoofed_referer_response_body.bin","size":84,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/dotsegment_public_prefix_variant_meta.json","filename":"dotsegment_public_prefix_variant_meta.json","size":933,"category":"other"},{"path":"bundle/repro/runtime_manifest.json","filename":"runtime_manifest.json","size":14771,"category":"other"},{"path":"bundle/logs/reproduction_steps.log","filename":"reproduction_steps.log","size":2710,"category":"log"},{"path":"bundle/logs/reproduction_steps_20260722T055646Z-13223.log","filename":"reproduction_steps_20260722T055646Z-13223.log","size":2710,"category":"log"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/matrix_summary.json","filename":"matrix_summary.json","size":1667,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/source/vuln_source_identity.json","filename":"vuln_source_identity.json","size":1810,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/source/protected_media_hunks.log","filename":"protected_media_hunks.log","size":2810,"category":"log"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/prepared_runtime/vuln/prepare_runtime.log","filename":"prepare_runtime.log","size":27993,"category":"log"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/prepared_runtime/fixed/prepare_runtime.log","filename":"prepare_runtime.log","size":27993,"category":"log"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/attempt_result.json","filename":"attempt_result.json","size":337,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/container_inspect.json","filename":"container_inspect.json","size":10653,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/health_response_headers.txt","filename":"health_response_headers.txt","size":487,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/trigger_spoofed_referer_curl_stderr.txt","filename":"trigger_spoofed_referer_curl_stderr.txt","size":0,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/trigger_spoofed_referer_meta.json","filename":"trigger_spoofed_referer_meta.json","size":1154,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/modified_file_inventory_after_startup.txt","filename":"modified_file_inventory_after_startup.txt","size":0,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/private_canary.txt","filename":"private_canary.txt","size":78,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/public_canary.txt","filename":"public_canary.txt","size":55,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/attempt_setup.json","filename":"attempt_setup.json","size":450,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/server_final.log","filename":"server_final.log","size":773,"category":"log"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/server_startup.log","filename":"server_startup.log","size":455,"category":"log"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/container_id.txt","filename":"container_id.txt","size":65,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/container_inspect.json","filename":"container_inspect.json","size":10655,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/health_response_headers.txt","filename":"health_response_headers.txt","size":487,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/health_response_body.txt","filename":"health_response_body.txt","size":16,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/public_liveness_request.txt","filename":"public_liveness_request.txt","size":216,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/public_liveness_response_headers.txt","filename":"public_liveness_response_headers.txt","size":565,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/public_liveness_response_body.bin","filename":"public_liveness_response_body.bin","size":55,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/public_liveness_curl_trace.txt","filename":"public_liveness_curl_trace.txt","size":1623,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/public_liveness_curl_stderr.txt","filename":"public_liveness_curl_stderr.txt","size":0,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/public_liveness_meta.json","filename":"public_liveness_meta.json","size":945,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/baseline_no_referer_request.txt","filename":"baseline_no_referer_request.txt","size":217,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/baseline_no_referer_response_headers.txt","filename":"baseline_no_referer_response_headers.txt","size":748,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/baseline_no_referer_response_body.bin","filename":"baseline_no_referer_response_body.bin","size":0,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/baseline_no_referer_curl_trace.txt","filename":"baseline_no_referer_curl_trace.txt","size":1767,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/baseline_no_referer_curl_stderr.txt","filename":"baseline_no_referer_curl_stderr.txt","size":0,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/baseline_no_referer_meta.json","filename":"baseline_no_referer_meta.json","size":1126,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/trigger_spoofed_referer_request.txt","filename":"trigger_spoofed_referer_request.txt","size":238,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/trigger_spoofed_referer_response_headers.txt","filename":"trigger_spoofed_referer_response_headers.txt","size":540,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/trigger_spoofed_referer_response_body.bin","filename":"trigger_spoofed_referer_response_body.bin","size":78,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/trigger_spoofed_referer_curl_trace.txt","filename":"trigger_spoofed_referer_curl_trace.txt","size":1667,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/server_final.log","filename":"server_final.log","size":771,"category":"log"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/trigger_spoofed_referer_curl_stderr.txt","filename":"trigger_spoofed_referer_curl_stderr.txt","size":0,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/trigger_spoofed_referer_meta.json","filename":"trigger_spoofed_referer_meta.json","size":948,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/modified_file_inventory_after_startup.txt","filename":"modified_file_inventory_after_startup.txt","size":0,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/private_canary.txt","filename":"private_canary.txt","size":79,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/public_canary.txt","filename":"public_canary.txt","size":56,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/attempt_setup.json","filename":"attempt_setup.json","size":453,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/container_id.txt","filename":"container_id.txt","size":65,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/container_inspect.json","filename":"container_inspect.json","size":10662,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/health_response_headers.txt","filename":"health_response_headers.txt","size":487,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/health_response_body.txt","filename":"health_response_body.txt","size":16,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/public_liveness_request.txt","filename":"public_liveness_request.txt","size":217,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/server_startup.log","filename":"server_startup.log","size":455,"category":"log"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/public_liveness_response_headers.txt","filename":"public_liveness_response_headers.txt","size":566,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/public_liveness_response_body.bin","filename":"public_liveness_response_body.bin","size":56,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/public_liveness_curl_trace.txt","filename":"public_liveness_curl_trace.txt","size":1626,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/baseline_no_referer_response_body.bin","filename":"baseline_no_referer_response_body.bin","size":0,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/baseline_no_referer_curl_trace.txt","filename":"baseline_no_referer_curl_trace.txt","size":1768,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/baseline_no_referer_curl_stderr.txt","filename":"baseline_no_referer_curl_stderr.txt","size":0,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/baseline_no_referer_meta.json","filename":"baseline_no_referer_meta.json","size":1127,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/trigger_spoofed_referer_request.txt","filename":"trigger_spoofed_referer_request.txt","size":239,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/trigger_spoofed_referer_response_headers.txt","filename":"trigger_spoofed_referer_response_headers.txt","size":748,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/trigger_spoofed_referer_response_body.bin","filename":"trigger_spoofed_referer_response_body.bin","size":0,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/trigger_spoofed_referer_curl_trace.txt","filename":"trigger_spoofed_referer_curl_trace.txt","size":1813,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/trigger_spoofed_referer_curl_stderr.txt","filename":"trigger_spoofed_referer_curl_stderr.txt","size":0,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/trigger_spoofed_referer_meta.json","filename":"trigger_spoofed_referer_meta.json","size":1154,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/modified_file_inventory_after_startup.txt","filename":"modified_file_inventory_after_startup.txt","size":0,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/server_final.log","filename":"server_final.log","size":773,"category":"log"},{"path":"bundle/vuln_variant/variant_manifest.json","filename":"variant_manifest.json","size":2981,"category":"other"},{"path":"bundle/vuln_variant/validation_verdict.json","filename":"validation_verdict.json","size":1154,"category":"other"},{"path":"bundle/vuln_variant/source_identity.json","filename":"source_identity.json","size":856,"category":"other"},{"path":"bundle/vuln_variant/patch_analysis.md","filename":"patch_analysis.md","size":8783,"category":"documentation"},{"path":"bundle/vuln_variant/runtime_manifest.json","filename":"runtime_manifest.json","size":10141,"category":"other"},{"path":"bundle/logs/vuln_variant/reproduction_steps_20260722T061846Z-17685.log","filename":"reproduction_steps_20260722T061846Z-17685.log","size":1979,"category":"log"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/source/fixed_worktree_head.txt","filename":"fixed_worktree_head.txt","size":41,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/source/patch_and_security_scope.log","filename":"patch_and_security_scope.log","size":10905,"category":"log"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/source/vuln_tested_commit.txt","filename":"vuln_tested_commit.txt","size":41,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/source/vuln_worktree_head.txt","filename":"vuln_worktree_head.txt","size":41,"category":"other"},{"path":"bundle/repro/validation_verdict.json","filename":"validation_verdict.json","size":742,"category":"other"},{"path":"bundle/logs/vuln_variant/latest_matrix_summary.json","filename":"latest_matrix_summary.json","size":1274,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/direct_private_spoofed_referer_curl_stderr.txt","filename":"direct_private_spoofed_referer_curl_stderr.txt","size":0,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/direct_private_spoofed_referer_curl_trace.txt","filename":"direct_private_spoofed_referer_curl_trace.txt","size":1818,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/direct_private_spoofed_referer_meta.json","filename":"direct_private_spoofed_referer_meta.json","size":1152,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/public_liveness_request.txt","filename":"public_liveness_request.txt","size":222,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/public_liveness_response_body.bin","filename":"public_liveness_response_body.bin","size":62,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/public_liveness_response_headers.txt","filename":"public_liveness_response_headers.txt","size":564,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/server_final.log","filename":"server_final.log","size":888,"category":"log"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/server_startup.log","filename":"server_startup.log","size":455,"category":"log"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/attempt_result.json","filename":"attempt_result.json","size":478,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/attempt_setup.json","filename":"attempt_setup.json","size":590,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/container_id.txt","filename":"container_id.txt","size":65,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/container_inspect.json","filename":"container_inspect.json","size":10587,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/dotsegment_public_prefix_variant_response_body.bin","filename":"dotsegment_public_prefix_variant_response_body.bin","size":84,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/dotsegment_public_prefix_variant_response_headers.txt","filename":"dotsegment_public_prefix_variant_response_headers.txt","size":538,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/health_response_body.txt","filename":"health_response_body.txt","size":16,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/health_response_headers.txt","filename":"health_response_headers.txt","size":487,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/media/base/icon/liveness-20260722T061846Z-17685-vuln.txt","filename":"liveness-20260722T061846Z-17685-vuln.txt","size":61,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/media/private-data/20260722T061846Z-17685/vuln-secret.txt","filename":"vuln-secret.txt","size":84,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/modified_file_inventory_after_startup.txt","filename":"modified_file_inventory_after_startup.txt","size":0,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/private_canary.txt","filename":"private_canary.txt","size":84,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/public_canary.txt","filename":"public_canary.txt","size":61,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/public_liveness_curl_stderr.txt","filename":"public_liveness_curl_stderr.txt","size":0,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/public_liveness_curl_trace.txt","filename":"public_liveness_curl_trace.txt","size":1632,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/server_final.log","filename":"server_final.log","size":885,"category":"log"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/public_liveness_meta.json","filename":"public_liveness_meta.json","size":941,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/public_liveness_request.txt","filename":"public_liveness_request.txt","size":221,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/public_liveness_response_body.bin","filename":"public_liveness_response_body.bin","size":61,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/public_liveness_response_headers.txt","filename":"public_liveness_response_headers.txt","size":563,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/cache_context_resolved.json","filename":"cache_context_resolved.json","size":204,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/deps/fixed_7fb44184827cf327_pip_freeze.txt","filename":"fixed_7fb44184827cf327_pip_freeze.txt","size":2139,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/deps/vuln_f86e9625862fa828_pip_freeze.txt","filename":"vuln_f86e9625862fa828_pip_freeze.txt","size":2125,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/matrix_summary.json","filename":"matrix_summary.json","size":1274,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/prepared_runtime/fixed/modified_file_inventory_after_prepare.txt","filename":"modified_file_inventory_after_prepare.txt","size":0,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/source/fixed_source_identity.json","filename":"fixed_source_identity.json","size":1956,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_2/attempt_result.json","filename":"attempt_result.json","size":337,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/attempt_result.json","filename":"attempt_result.json","size":338,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/attempt_result.json","filename":"attempt_result.json","size":338,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/private_canary.txt","filename":"private_canary.txt","size":78,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/cache_context_resolved.json","filename":"cache_context_resolved.json","size":227,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/source/vuln_worktree_head.txt","filename":"vuln_worktree_head.txt","size":41,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/source/fixed_worktree_head.txt","filename":"fixed_worktree_head.txt","size":41,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/container_id.txt","filename":"container_id.txt","size":65,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/health_response_body.txt","filename":"health_response_body.txt","size":16,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/server_startup.log","filename":"server_startup.log","size":455,"category":"log"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/public_liveness_request.txt","filename":"public_liveness_request.txt","size":216,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/public_liveness_response_headers.txt","filename":"public_liveness_response_headers.txt","size":565,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/public_liveness_response_body.bin","filename":"public_liveness_response_body.bin","size":55,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/public_liveness_curl_trace.txt","filename":"public_liveness_curl_trace.txt","size":1623,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/public_liveness_curl_stderr.txt","filename":"public_liveness_curl_stderr.txt","size":0,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/server_final.log","filename":"server_final.log","size":771,"category":"log"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/attempt_setup.json","filename":"attempt_setup.json","size":453,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/container_id.txt","filename":"container_id.txt","size":65,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/container_inspect.json","filename":"container_inspect.json","size":10661,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/health_response_headers.txt","filename":"health_response_headers.txt","size":487,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/health_response_body.txt","filename":"health_response_body.txt","size":16,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/server_startup.log","filename":"server_startup.log","size":455,"category":"log"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/trigger_spoofed_referer_curl_trace.txt","filename":"trigger_spoofed_referer_curl_trace.txt","size":1813,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/public_liveness_curl_stderr.txt","filename":"public_liveness_curl_stderr.txt","size":0,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/prepared_runtime/fixed/prepare_runtime.log","filename":"prepare_runtime.log","size":27993,"category":"log"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/baseline_no_referer_request.txt","filename":"baseline_no_referer_request.txt","size":217,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/baseline_no_referer_response_headers.txt","filename":"baseline_no_referer_response_headers.txt","size":748,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/trigger_spoofed_referer_request.txt","filename":"trigger_spoofed_referer_request.txt","size":238,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/trigger_spoofed_referer_response_headers.txt","filename":"trigger_spoofed_referer_response_headers.txt","size":540,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/trigger_spoofed_referer_response_body.bin","filename":"trigger_spoofed_referer_response_body.bin","size":78,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/trigger_spoofed_referer_request.txt","filename":"trigger_spoofed_referer_request.txt","size":239,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/trigger_spoofed_referer_response_headers.txt","filename":"trigger_spoofed_referer_response_headers.txt","size":748,"category":"other"},{"path":"bundle/logs/pip_install_vuln_f86e9625862fa828_20260722T055646Z-13223.log","filename":"pip_install_vuln_f86e9625862fa828_20260722T055646Z-13223.log","size":156,"category":"log"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/deps/vuln_f86e9625862fa828_pip_freeze.txt","filename":"vuln_f86e9625862fa828_pip_freeze.txt","size":2125,"category":"other"},{"path":"bundle/logs/pip_install_fixed_7fb44184827cf327_20260722T055646Z-13223.log","filename":"pip_install_fixed_7fb44184827cf327_20260722T055646Z-13223.log","size":156,"category":"log"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/deps/fixed_7fb44184827cf327_pip_freeze.txt","filename":"fixed_7fb44184827cf327_pip_freeze.txt","size":2139,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/prepared_runtime/vuln/modified_file_inventory_after_prepare.txt","filename":"modified_file_inventory_after_prepare.txt","size":0,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/prepared_runtime/fixed/modified_file_inventory_after_prepare.txt","filename":"modified_file_inventory_after_prepare.txt","size":0,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/public_canary.txt","filename":"public_canary.txt","size":55,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/attempt_setup.json","filename":"attempt_setup.json","size":450,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/public_liveness_meta.json","filename":"public_liveness_meta.json","size":945,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/baseline_no_referer_response_body.bin","filename":"baseline_no_referer_response_body.bin","size":0,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/baseline_no_referer_curl_trace.txt","filename":"baseline_no_referer_curl_trace.txt","size":1767,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/baseline_no_referer_curl_stderr.txt","filename":"baseline_no_referer_curl_stderr.txt","size":0,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/baseline_no_referer_meta.json","filename":"baseline_no_referer_meta.json","size":1126,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/trigger_spoofed_referer_curl_trace.txt","filename":"trigger_spoofed_referer_curl_trace.txt","size":1667,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/trigger_spoofed_referer_curl_stderr.txt","filename":"trigger_spoofed_referer_curl_stderr.txt","size":0,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/trigger_spoofed_referer_meta.json","filename":"trigger_spoofed_referer_meta.json","size":948,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/vuln_1/modified_file_inventory_after_startup.txt","filename":"modified_file_inventory_after_startup.txt","size":0,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/private_canary.txt","filename":"private_canary.txt","size":79,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/public_canary.txt","filename":"public_canary.txt","size":56,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/public_liveness_request.txt","filename":"public_liveness_request.txt","size":217,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/public_liveness_response_headers.txt","filename":"public_liveness_response_headers.txt","size":566,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/public_liveness_response_body.bin","filename":"public_liveness_response_body.bin","size":56,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/public_liveness_curl_trace.txt","filename":"public_liveness_curl_trace.txt","size":1626,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/direct_private_no_referer_response_headers.txt","filename":"direct_private_no_referer_response_headers.txt","size":748,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/public_liveness_meta.json","filename":"public_liveness_meta.json","size":947,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/baseline_no_referer_request.txt","filename":"baseline_no_referer_request.txt","size":218,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/baseline_no_referer_response_headers.txt","filename":"baseline_no_referer_response_headers.txt","size":748,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/baseline_no_referer_response_body.bin","filename":"baseline_no_referer_response_body.bin","size":0,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/baseline_no_referer_curl_trace.txt","filename":"baseline_no_referer_curl_trace.txt","size":1768,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/baseline_no_referer_curl_stderr.txt","filename":"baseline_no_referer_curl_stderr.txt","size":0,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/baseline_no_referer_meta.json","filename":"baseline_no_referer_meta.json","size":1127,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_1/trigger_spoofed_referer_response_body.bin","filename":"trigger_spoofed_referer_response_body.bin","size":0,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/public_liveness_meta.json","filename":"public_liveness_meta.json","size":947,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/baseline_no_referer_request.txt","filename":"baseline_no_referer_request.txt","size":218,"category":"other"},{"path":"bundle/artifacts/horilla_referer_bypass/20260722T055646Z-13223/attempts/fixed_2/baseline_no_referer_response_headers.txt","filename":"baseline_no_referer_response_headers.txt","size":748,"category":"other"},{"path":"bundle/logs/vuln_variant/fixed_version.txt","filename":"fixed_version.txt","size":229,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/attempt_result.json","filename":"attempt_result.json","size":479,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/dotsegment_public_prefix_variant_request.txt","filename":"dotsegment_public_prefix_variant_request.txt","size":239,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/dotsegment_public_prefix_variant_response_body.bin","filename":"dotsegment_public_prefix_variant_response_body.bin","size":85,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/private_canary.txt","filename":"private_canary.txt","size":85,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/attempt_setup.json","filename":"attempt_setup.json","size":594,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/container_id.txt","filename":"container_id.txt","size":65,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/container_inspect.json","filename":"container_inspect.json","size":10593,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/direct_private_no_referer_curl_stderr.txt","filename":"direct_private_no_referer_curl_stderr.txt","size":0,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/direct_private_no_referer_curl_trace.txt","filename":"direct_private_no_referer_curl_trace.txt","size":1773,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/direct_private_no_referer_meta.json","filename":"direct_private_no_referer_meta.json","size":1125,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/direct_private_no_referer_request.txt","filename":"direct_private_no_referer_request.txt","size":223,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/direct_private_no_referer_response_body.bin","filename":"direct_private_no_referer_response_body.bin","size":0,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/dotsegment_public_prefix_variant_curl_stderr.txt","filename":"dotsegment_public_prefix_variant_curl_stderr.txt","size":0,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/dotsegment_public_prefix_variant_curl_trace.txt","filename":"dotsegment_public_prefix_variant_curl_trace.txt","size":1650,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/dotsegment_public_prefix_variant_meta.json","filename":"dotsegment_public_prefix_variant_meta.json","size":935,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/dotsegment_public_prefix_variant_response_headers.txt","filename":"dotsegment_public_prefix_variant_response_headers.txt","size":539,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/health_response_body.txt","filename":"health_response_body.txt","size":16,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/health_response_headers.txt","filename":"health_response_headers.txt","size":487,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/media/base/icon/liveness-20260722T061846Z-17685-fixed.txt","filename":"liveness-20260722T061846Z-17685-fixed.txt","size":62,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/media/private-data/20260722T061846Z-17685/fixed-secret.txt","filename":"fixed-secret.txt","size":85,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/modified_file_inventory_after_startup.txt","filename":"modified_file_inventory_after_startup.txt","size":0,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/public_canary.txt","filename":"public_canary.txt","size":62,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/public_liveness_curl_stderr.txt","filename":"public_liveness_curl_stderr.txt","size":0,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/public_liveness_curl_trace.txt","filename":"public_liveness_curl_trace.txt","size":1635,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/fixed/public_liveness_meta.json","filename":"public_liveness_meta.json","size":943,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/direct_private_no_referer_curl_stderr.txt","filename":"direct_private_no_referer_curl_stderr.txt","size":0,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/direct_private_no_referer_curl_trace.txt","filename":"direct_private_no_referer_curl_trace.txt","size":1772,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/direct_private_no_referer_meta.json","filename":"direct_private_no_referer_meta.json","size":1124,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/direct_private_no_referer_request.txt","filename":"direct_private_no_referer_request.txt","size":222,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/direct_private_no_referer_response_body.bin","filename":"direct_private_no_referer_response_body.bin","size":0,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/direct_private_no_referer_response_headers.txt","filename":"direct_private_no_referer_response_headers.txt","size":748,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/direct_private_spoofed_referer_response_headers.txt","filename":"direct_private_spoofed_referer_response_headers.txt","size":538,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/dotsegment_public_prefix_variant_curl_stderr.txt","filename":"dotsegment_public_prefix_variant_curl_stderr.txt","size":0,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/dotsegment_public_prefix_variant_curl_trace.txt","filename":"dotsegment_public_prefix_variant_curl_trace.txt","size":1647,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/dotsegment_public_prefix_variant_request.txt","filename":"dotsegment_public_prefix_variant_request.txt","size":238,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/attempts/vuln/server_startup.log","filename":"server_startup.log","size":455,"category":"log"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/prepared_runtime/vuln/modified_file_inventory_after_prepare.txt","filename":"modified_file_inventory_after_prepare.txt","size":0,"category":"other"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/prepared_runtime/vuln/prepare_runtime.log","filename":"prepare_runtime.log","size":27993,"category":"log"},{"path":"bundle/vuln_variant/runtime_20260722T061846Z-17685/source/fixed_tested_commit.txt","filename":"fixed_tested_commit.txt","size":41,"category":"other"}]}