With PageBreak, every vulnerability hypothesis is tested against a running environment with a real exploit, such as executing JavaScript for XSS, writing to a world-readable location for path traversal, or triggering outbound DNS for RCE. Michał Bentkowski, information security engineer at Google, explains: Early on in the development of PageBreak, we made a conscious decision to prioritize deterministic validation. Rather than simply hypothesizing bugs based on code patterns, the system closes the loop by verifying potential flaws against running environments.
This approach results in a near-zero false positive rate, ensuring that we avoid overloading product teams with unverified vulnerability reports. Google also retains non-deterministic findings internally to seed deeper future scans, identify gaps in its validation capabilities, and guide the development of new validators. These unverified candidates are not sent to product teams, keeping their attention focused on high-confidence vulnerabilities.
