Coverage and reuse map
This matrix shows which canonical procedures are reused across target playbooks. It measures the manual's content coverage. It does not assert that a target was tested, a control passed, or a finding exists.
Catalog entries by target family Documentation coverage, not vulnerability prevalence or tests completed. An entry may apply to several families.
OSS & self-hosted 113 Web & API 69 Network services 20 Mobile 60 Desktop & extensions 63 Cloud & containers 60 AI, agents & MCP 50 Web3 & protocols 11 Hardware & firmware 15 Shared procedures by target family#
Reusable procedure OSS & self-hosted Web & API Network services Mobile Desktop & extensions Cloud & containers AI, agents & MCP Web3 & protocols Hardware & firmware Object, function, and property authorization Used Used — Used Used Used Used — — Authentication, recovery, federation, and session lifecycle Used Used — Used Used Used Used — — Trace input into queries, commands, and templates Used Used — Used Used Used Used — — Server-side fetching and network trust boundaries Used Used — — Used Used Used — — Browser execution, cross-origin reads, and forged actions Used Used — Used Used — Used — — Uploads, downloads, paths, archives, and XML Used Used — Used Used Used Used — — Workflow invariants, replay, idempotency, and races Used Used — Used Used Used — Used — REST, GraphQL, gRPC, WebSocket, and SSE permission parity Used Used — Used Used Used Used — — Proxy normalization, cache isolation, and request boundaries Used Used Used — — Used — — — OSS lab: pin, install, prove, reset Used Used — — Used — Used — — Source review: entry point to protected operation Used Used — Used Used — Used — — CI and releases: trace untrusted input into privileged work Used — — Used Used Used Used — — Dependencies: from advisory match to reachable impact Used Used — Used Used Used Used — — Libraries and parsers: bounded fuzzing to a minimal reproducer Used — Used Used Used — Used — Used Cloud IAM: trust, delegation and effective permissions — — — — — Used — — — Object storage, signed URLs and delivery boundaries Used Used — — — Used — — — Container and Kubernetes isolation Used — — — — Used — — — Infrastructure configuration: from repository default to deployed impact Used — — — — Used — — — DNS, TLS and email trust boundaries — — Used — — Used — — — Database, cache, queue and management service boundaries Used — Used — — Used — — — Android components, intents and deep links — — — Used — — — — — iOS signing capabilities, links and protected data — — — Used — — — — — Client storage, logs, backup and transport trust — — — Used Used — — — — Desktop IPC, Electron bridges and native protocols — — — — Used — — — — Update signatures, rollback and privileged installation — — — Used Used — — — — AI tools: input trust, execution identity and approvals Used — — — — — Used — — RAG isolation: ingestion, retrieval, citations and revocation Used Used — — — — Used — — Contract state: authorization, callbacks and accounting Used — — — — — — Used — Contract signatures and oracles: context, freshness and units Used — — — — — — Used — Firmware update and boot trust: signed bytes, product binding and rollback Used — — — — — — — Used Hardware interfaces: production debug access and protected data — — Used — — — — — Used MFA and passkeys: enrollment, proof, replacement, and recovery Used Used — Used Used Used — — — OAuth, OIDC, and SAML: transaction binding and token trust Used Used — Used Used Used Used — — Request values: duplicate parameters, parser conflicts and downstream queries Used Used — — — Used Used — — Webhooks and integration events: authenticity, tenant binding and replay Used Used — — — Used Used — — GitLab pipelines: contribution, job token and runner boundaries Used — — — — Used — — — Azure and GCP: identity, delegation and storage access Used Used — — — Used — — — Browser extensions: message authority and document lifetime Used Used — — Used — — — — AI state: memory, resumed work, retries and private caches Used Used — — — — Used — — Resource budgets and sensitive business flows Used Used — — — Used Used — —