bugbounty-poc-video-runnerlisted

# Security PoC Video Runner Use this procedure when a vulnerability has already been reproduced on an authorized live target and needs a concise video for security triage. ## Goal Turn the verified reproduction into one command that tells a complete evidence story. The operator should only start recording, run the command, optionally open one printed UI URL, and stop recording. The video is evidence, not a setup tutorial. ## Non-negotiable evidence The runner must use the genuine target, production code paths, real identities, and real HTTP requests. Never mock, simulate, patch target behavior, or print invented success messages. Show these facts explicitly: 1. Authorized target identity and live health. 2. Expected security invariant and expected observable result. 3. Isolated fixture creation through genuine application paths. 4. Security-relevant precondition state immediately before the request. 5. Exact request method and path, without secrets. 6. HTTP status, request/correlation ID, decisive response fields, and persisted effect. 7. A negative control that changes only the suspected authorization source where possible. 8. Expected-versus-actual comparison. 9. Cleanup result and remaining-object audit. ## Preflight plan Before implementation, identify: - the authorized target and operator-confirmed scope; - fixture creation paths and a unique ownership prefix; - the affected public request; - an independent persistence check; - the single variable changed by t