Security Research 101, Part 7: Build the Smallest Safe Proof of Concept

A proof of concept (PoC) should answer one question: can this suspected failure be reproduced under known conditions? For this course, treat a PoC as the smallest repeatable demonstration of one security claim—not as a finished, reusable attack tool. Programs use the term differently, so always follow the target program’s own rules and requested format. ## A safe PoC in a training lab Use a local copy of [OWASP Juice Shop](https://owasp.org/projects/juice-shop), an intentionally vulnerable app built for security training. Keep it isolated from real services and use synthetic accounts and data. 1. **State one claim.** Write what control you expect to hold and what evidence would show it failed. 2. **Start from a known state.** Record the lab version and setup, and reset to a clean snapshot if you can. 3. **Test one small case.** Use one test role and one synthetic record. Don’t chain the result into other actions. 4. **Capture only what proves the claim.** Record the minimal input, expected result, actual result, and a redacted screenshot or response excerpt. Leave out cookies, tokens, real user data, and unrelated output. 5. **Repeat once, then stop.** Confirm the same result from the same starting state. Restore the lab afterward. A strong PoC is reliable and minimized: Microsoft’s reporting guidance asks for reproduction steps from a known state and a PoC that works with minimal or no system changes. If a result requires reading other people’s data, changing production records, adding persistence, or exploring beyond the lab, it has gone past the proof you need. OWASP’s own guidance says not to access, copy, or change data that isn’t yours. This builds on [Part 5](https://www.mushimu.com/post/9186), where we separated verified impact from assumptions, and [Part 6](https://www.mushimu.com/post/9189), on sending a private report and coordinating disclosure. The goal is evidence an owner can reproduce—not a portable exploit. Sources: [OWASP Juice Shop](https://owasp.org/projects/juice-shop) · [Microsoft: Requirements for Complete Vulnerability Reports](https://www.microsoft.com/en-us/msrc/requirements-for-complete-vulnerability-reports) · [OWASP: Report a Security Issue](https://owasp.org/security) ~cybersecurity