What is Clean-session reproduction?
Re-exploiting a candidate vulnerability from a fresh session with no leftover state, to prove it is real and not an artefact of a prior step.
Clean-session reproduction: Re-exploiting a candidate vulnerability from a fresh session with no leftover state, to prove it is real and not an artefact of a prior step.
In plain language
A candidate found mid-test might depend on state built up along the way — a cached token, a prior request. Clean-session reproduction throws all of that away: a new login, a fresh session, and the exploit run again from scratch. If it still works, it is real.
This is SuperPentest’s moat and its honesty rule in one: nothing is reported until it is broken into again from a clean start. It is why a finding here means proven, not suspected. How findings are verified →
A concrete example
A tester finds an admin panel open — but only because an earlier step left an elevated cookie in the session. Reported as-is, it would send engineers chasing a ghost. Clean-session reproduction logs out, starts fresh, and tries again; if the panel is still open with no prior state, it is a genuine finding. If not, it never reaches the report.
Related
How findings are verified → · False positive →
Want this tested on your app? Book a demo or read how findings are verified.