Inspect the capsule first
A proof capsule is a JSON artifact containing a finding and a recipe for checking it. Review the target and requested operation before replaying a capsule from someone else. Replaying it makes real requests.
Run only against a target you are authorized to assess. Treat evidence as potentially sensitive: it may include routes, response details and information about the weakness.
Run the recorded check
ptai replay path/to/proof-capsule.json
The target must still be reachable and the necessary test conditions must still
exist. Not every finding has a replayable recipe. Use ptai replay --help for
the options in your installed version.
For a machine-readable result:
ptai replay path/to/proof-capsule.json --ci
This command exits successfully only when the finding is re-verified. A replay failure does not, on its own, prove a fix: inspect whether the oracle rejected the exploit or could not complete because of an environmental problem.
Check a fix
- Preserve the original capsule and the affected application's version.
- Apply the fix in an authorized test environment.
- Re-run the recorded check under comparable conditions.
- Review the result and retain both the original and follow-up evidence.
The bundled ptai demo demonstrates this distinction using a temporary local
application and its hardened routes. Its server is not left running after the
demo ends.
Share evidence carefully
Share capsules through your team's approved channels. Review and redact secrets before publishing any evidence. The capsule's integrity hash detects changes, but does not identify a trusted author or make untrusted content safe to execute.