We've covered a lot about what you should look for—the structure of vulnerabilities, and how to test for them in both programmatic and manual ways.
It seems unimportant to talk about what you shouldn't look for—if you don't care about it, you'll just ignore it, right? But there are several common findings and false positives that you'll see being spit out by scanners, passive analysis tools, extensions, and command-line logs again and again. It's useful to have an idea of what vulnerabilities companies are not interested in so that you can both avoid wasting your time submitting doomed bug reports and configure your tools to report less noise to you in the first place.
The common theme for most of the vulnerabilities we'll cover here are that they don't have a clear path to exploitation...
