Banked 2026-07-28 from the Docker cycle655 disclosure (unauth SSRF, incomplete-fix of CVE-2026-33990). Two disclosure-discipline lessons; both feed the pre-send drill.
When the vulnerable file has multiple branches that all reach the sink, the write-up must attribute the root cause to the SPECIFIC branch your PoC actually fires - not the most-interesting-looking one.
cycle655 example: docker/model-runner remote.go had TWO unguarded redirect-follow paths:
- The outer http.Client built by createResolver has NO CheckRedirect, so Go's DEFAULT redirect policy follows the registry 302 - this fires on EVERY fresh pull (the common case, and what the PoC triggers).
- rangeTransport.RoundTrip's own transport-level redirect loop follows redirects too - BUT it is gated on requestedOffset > 0 (resumed / Range pulls only).
Both are unguarded, but if the advisory pins the bug ONLY on the eye-catching rangeTransport loop, a maintainer can push back "that path only runs on resumed downloads" and deflate the finding. The correct framing names the fresh-pull http.Client path as the primary (unconditional) SSRF and the Range loop as a second, conditionally-reached path. Trace which branch your PoC's request actually takes (add logging / read the gating condition) and lead with THAT.
Rule: for a multi-branch sink, (a) identify every branch that reaches it, (b) determine which one your PoC/repro traverses and under what precondition, (c) lead the write-up with the least-conditional confirmed branch, (d) list the others as additional paths with their preconditions. Never let the headline rest on a branch gated by a condition your PoC did not exercise.
Maintainers silently patch main between find-time and send-time. Right BEFORE the operator sends, re-confirm the unguarded code is STILL present on BOTH the latest RELEASE tag AND current origin/main HEAD (git fetch / raw-fetch the sink at HEAD), and RECORD the HEAD sha in the submission. This (a) prevents sending an already-silently-fixed bug (embarrassing + $0), and (b) timestamps the affected-at-HEAD claim so the vendor cannot say "not reproducible" against a later HEAD. The cycle655 sent body did this ("v1.2.6 (latest) and current main HEAD").
Rule: the pre-send checklist = re-run the disclosure gate (open issues/PRs/advisories naming the exact sink) + re-verify the sink is unguarded at latest-release-tag AND main-HEAD + record the HEAD sha in the report. Same discipline as the banked submit-time-disclosure-recheck, extended to the code-currency axis.
Related: [[feedback_submit_time_disclosure_recheck_swarmed_class]], [[feedback_ssrf_fix_guards_realm_not_blob_redirect]]. Coordinator mirrored both into the laptop cve-disclosure-send-drill skill + appended the box incomplete-fix-advisory-audit skill.