This might not always work, but whenever possible, a working exploit could be demanded, working in a form that can be automatically verified to work.