Hack Hydra · findings
What HydraDB 0.1.0 cannot do
The organizers asked people to surface what does not work. A list in a README is a claim, so this page re-derives the whole thing against the running database instead — every probe below was executed live, and the page says how long ago.
The parse-time rejections are the cheap half: they are loud, the error tells you what happened, and you lose minutes. The silent failures are the expensive half. Nothing raises, the shape looks right, and the answer is wrong — the first one below made every uncrawled package report an empty blast radius, which reads as safe. That is the worst possible way for a security tool to be wrong, and it cost days to find.
The ones that fail silently — far more expensive
Each is re-run live, wrong version beside corrected version, so the difference is visible rather than described.
The query surface , probe by probe
The same probe set that produced the constraint table in the README —
imported from probe_constraints.py rather than copied, so the
two cannot drift apart.
Two findings a probe cannot answer
Real, measured, and not a boolean — so they are listed as prose and labelled as such rather than dressed up as live checks.