# Mobile

## Scope and learning route

Mobile bounty work means testing an explicitly identified application and its reachable trust boundaries. Record the Android package ID or iOS bundle ID, store URL, publisher, signing identity, version/build number, acquisition date, artifact SHA-256, OS version, architecture, and distribution channel. Include Android split APKs and dynamic features; an App Bundle is a publishing artifact, not necessarily the exact installed package set. Keep production, TestFlight, enterprise, debug, and locally compiled OSS builds distinct. A repository commit and a store build are separate evidence coordinates.

Treat backend domains, identity providers, analytics vendors, embedded SDKs, companion apps, and operating-system components as independently scoped assets. A mobile package listing does not automatically authorize arbitrary testing of every URL recovered from it. Likewise, a hostname containing “mobile” in a discovery list establishes neither app identity nor testing authorization. For OSS, reproduce against a locally built release or documented self-hosted backend; do not use maintainers’ demo infrastructure unless its policy includes it.

Use **MASVS** to organize required security properties, **MASTG** for testing techniques, and **MASWE** to name weaknesses. They serve different purposes; a control failure is not automatically bounty-eligible. Record the exact taxonomy version or retrieval date, since identifiers and test mappings evolve. [OWASP MASVS](https://mas.owasp.org/MASVS/), [MASTG](https://mas.owasp.org/MASTG/), [MASWE](https://mas.owasp.org/MASWE/).

Recommended progression: package anatomy and platform permissions → storage and session lifecycle → exported interfaces and deep links → WebView bridges → native libraries and release differences. Advance when you can show an attacker-controlled entry point reaching a protected operation, explain the required privileges, and reproduce the result without changing the security property under test.

## Lab prerequisites

For Android, use an owned device or emulator, Android SDK Platform Tools, APK Analyzer/build tools, JADX, Apktool, and a scoped interception proxy. Start with an ordinary release installation; keep a separate instrumented image for tracing. Match API level, ABI, target SDK, split packages, and relevant Google-service dependencies. Decompiler output is a navigation aid: verify ambiguous control flow against bytecode, original source, or runtime behavior. [Android SDK tools](https://developer.android.com/tools/adb), [JADX](https://github.com/skylot/jadx).

For iOS, use a Mac with compatible Xcode tooling and an owned supported iPhone/iPad when device behavior matters. A simulator needs a simulator-compatible build; a normal device IPA is not interchangeable with one. Obtain source, symbols, or an authorized test build where available. Jailbreaking, repackaging, changed entitlements, and instrumentation alter assumptions and must be disclosed; unsupported hardware or unavailable binary access can limit coverage. [OWASP iOS Security Testing](https://mas.owasp.org/MASTG/0x06b-iOS-Security-Testing/).

Create two owned application accounts where allowed, seed recognizable synthetic records, and capture an untouched baseline. Keep backend traffic within the explicit scope. An interception certificate installed for the lab changes the trust environment: distinguish expected trust of that certificate from an app accepting invalid certificates without an approved trust anchor. Android debug trust overrides may deliberately change pinning behavior and are ignored in non-debuggable builds. [Android network security configuration](https://developer.android.com/privacy-and-security/security-config).

## Android playbook

1. **Establish provenance.** Inventory version, signature, complete package set, minimum/target SDK, and release flags. **Gate:** the artifact corresponds to the scoped release, or the report clearly limits its claim to another eligible build.
2. **Map external inputs.** Enumerate activities, services, receivers, providers, intent filters, URI grants, custom permissions, and dynamically registered interfaces. Trace inputs to sensitive reads, writes, navigation, account operations, and file handling. **Gate:** a reachable input exists under the proposed attacker privileges. An exported component may be intentional; export status alone proves no unauthorized operation. [Android exported components](https://developer.android.com/privacy-and-security/risks/android-exported).
3. **Exercise one boundary at a time.** Use a minimal companion test app to model an ordinary installed application. Check permission enforcement, caller identity, grants, and object ownership. ADB is useful for observation, but its shell identity may have privileges unavailable to an ordinary app. **Gate:** repeat the finding under the claimed attacker identity with synthetic data. Content-provider access combines URI identification with provider permissions and grants. [Android content providers](https://developer.android.com/guide/topics/providers/content-provider-basics).
4. **Trace links and embedded content.** Follow deep-link parameters through redirects, route selection, authentication gates, and WebView loading. Examine nested frames and native bridge exposure. **Gate:** untrusted input reaches protected functionality; merely opening a public screen is expected behavior. Verified links bind routing but do not replace authorization or input validation. [Android deep links](https://developer.android.com/privacy-and-security/risks/unsafe-use-of-deeplinks), [WebView native bridges](https://developer.android.com/privacy-and-security/risks/insecure-webview-native-bridges).
5. **Observe lifecycle and trust.** Compare storage, logs, caches, clipboard, notifications, backups, and tokens before login, after account switching, and after logout. Trace key use and local authentication rather than collecting every string resembling a secret. **Gate:** identify sensitive material, its actual exposure path, and an attacker who can access or reuse it.
6. **Validate release impact.** Reproduce the smallest meaningful result on the eligible build, with preconditions and negative controls. Report only the supported chain; label any backend conclusion requiring separately authorized testing as unverified.

## iOS playbook

1. **Fingerprint the application.** Record bundle/version identifiers, signing team, provisioning context, architecture, embedded extensions, and entitlement set. Review `Info.plist`, associated domains, App Groups, Keychain groups, URL types, document handlers, and ATS configuration. **Gate:** the inspected artifact and runtime installation match.
2. **Model shared capabilities.** Trace app-to-extension sharing, document imports, pasteboard access, URL handling, and WebView message handlers. Identify which sender or origin the app trusts. **Gate:** reproduce with a separately controlled input, without granting that input the target’s signing identity.
3. **Test URL transitions.** Cover logged-out, logged-in, expired-session, and account-switch states using harmless links and local fixtures. Verify sensitive operations still authorize the current account. Universal links use website/app association; custom schemes have different routing guarantees. Neither makes arbitrary URL parameters trustworthy. [Apple universal-link model](https://developer.apple.com/library/archive/documentation/General/Conceptual/AppSearch/UniversalLinks.html).
4. **Inspect data protection semantically.** Determine Keychain accessibility class, access group, synchronization, user-presence constraints, and whether sensitive operations use the protected key. Test lock/unlock and logout behavior against the product’s intended offline/background capabilities. **Gate:** demonstrate a violation of the intended access boundary, not simply that a secret exists while its owner is authenticated. [Apple Keychain data protection](https://support.apple.com/guide/security/keychain-data-protection-secb0694df1a/web).
5. **Trace network and native paths.** Examine trust-delegate behavior, ATS exceptions, authenticated WebViews, callback handling, imported files, and bundled native parsers. Use instrumentation to locate a cause, then separate observations introduced by instrumentation. **Gate:** the claimed result remains valid under documented release preconditions.

## Mobile hypotheses

| Hypothesis | Minimal controlled experiment | Evidence required before reporting |
|---|---|---|
| Exported Android provider exposes private data | Seed one record; request it from an unprivileged test app | Caller permissions, URI, synthetic record, expected denial |
| Deep link bypasses an account boundary | Open an owned-account resource link in a different owned session | Identity before/after, resulting unauthorized action/data |
| Web content reaches a privileged bridge | Load a harmless controlled page through a supported entry point | Origin/frame, exposed method, bounded protected operation |
| Logout leaves reusable authorization | Observe one owned token’s documented revocation lifecycle | Applicable policy, timing, separately scoped backend result |
| Local unlock is only a cosmetic gate | Trace whether protected data/key use requires authentication | Attacker prerequisite and actual protected data access |
| Imported file crosses a storage boundary | Import a synthetic file with a unique marker | Intended destination, actual destination, accessible privilege |

These are prioritization hypotheses, not claims that every listed behavior is a vulnerability. Screenshots, missing obfuscation, root detection, pinning, and generic API keys need program-specific impact and eligibility analysis.

## Mobile checklist

**Android**

- [ ] Package ID, publisher, store channel, version, hash, and signer recorded.
- [ ] Base and relevant split/dynamic-feature packages included.
- [ ] Device API, ABI, target SDK, and release/debug state recorded.
- [ ] Exported and dynamically registered components mapped.
- [ ] Component permissions and caller identity checked.
- [ ] Provider permissions, URI grants, and path handling reviewed.
- [ ] Intent forwarding and PendingIntent authority traced.
- [ ] Deep-link host, path, parameter, and session validation checked.
- [ ] WebView navigation, frames, and bridge methods mapped.
- [ ] Storage, logs, notifications, clipboard, and backups examined.
- [ ] Key storage, key use, and local authentication connected.
- [ ] Network trust behavior separated from lab CA changes.
- [ ] Account switching and logout tested with synthetic identities.
- [ ] Claimed ordinary-app issue reproduced without ADB-only privilege.

**iOS**

- [ ] Bundle ID, build, channel, hash, signing team, and device recorded.
- [ ] Simulator, device, and instrumented builds distinguished.
- [ ] `Info.plist` and embedded extension metadata inspected.
- [ ] Associated domains and custom URL schemes inventoried.
- [ ] URL parameters and account context validated independently.
- [ ] App Groups and Keychain access groups mapped.
- [ ] Keychain class, synchronization, and user-presence policy reviewed.
- [ ] Sensitive file protection evaluated for intended lock states.
- [ ] Extension and document-import trust boundaries exercised.
- [ ] WebView frames, navigation, and message handlers inspected.
- [ ] ATS configuration and actual certificate validation checked.
- [ ] Cache, logs, pasteboard, screenshots, and backup exposure assessed.
- [ ] Local authentication tied to sensitive data or key access.
- [ ] Re-signing/jailbreak limitations and release reproduction documented.

## Mobile command cheat sheet

Run these against owned lab devices and local artifacts. The commands inspect metadata or write analysis copies; they do not test discovered Internet hosts. Replace identifiers and paths deliberately. Android commands require the indicated SDK tools on `PATH`; JADX and Apktool require their supported Java runtime. [ADB](https://developer.android.com/tools/adb), [APK Analyzer](https://developer.android.com/tools/apkanalyzer), [APK signer](https://developer.android.com/tools/apksigner), [JADX CLI](https://github.com/skylot/jadx), [Apktool CLI](https://apktool.org/docs/cli-parameters/).

```bash
# Android: choose one owned device when more than one is attached.
adb devices -l
adb -s DEVICE_SERIAL shell pm path com.example.lab
adb -s DEVICE_SERIAL shell dumpsys package com.example.lab
apkanalyzer apk summary ./app.apk
apkanalyzer manifest print ./app.apk
apkanalyzer manifest permissions ./app.apk
apksigner verify --verbose --print-certs ./app.apk
jadx -d ./analysis-jadx ./app.apk
apktool d ./app.apk -o ./analysis-apktool
```

On macOS, inspect a locally acquired/extracted app without modifying its signature. `codesign` applies to both iOS bundles and macOS applications, but entitlements and runtime enforcement differ. Check installed `man plutil` / `man codesign` when tooling differs. [OWASP Plutil](https://mas.owasp.org/MASTG/tools/ios/MASTG-TOOL-0062/), [OWASP entitlement extraction](https://mas.owasp.org/MASTG/techniques/ios/MASTG-TECH-0111/).

```bash
plutil -p ./Payload/Lab.app/Info.plist
codesign -dv --verbose=4 ./Payload/Lab.app
codesign -d --entitlements :- ./Payload/Lab.app
```

## Native sign-in and privacy coverage matrix

Run identity tests through the shipped app and its authorized backend; a deep link opening a screen and a biometric prompt succeeding are only intermediate observations.

| Route | Controlled comparison | Required result |
|---|---|---|
| Native OAuth return | Normal callback versus another owned pending attempt | Code, verifier and transaction resolve to the correct final account |
| Account linking | Fresh link versus account-switch/cancelled flow | No external identity attaches to a different owned account |
| Passkey sign-in | Valid fixture versus wrong challenge/account fixture | The server rejects invalid assertions before session creation |
| Local protected key | Intended unlock versus supported alternate route | The protected operation observes the required local authentication state |
| Private UI/data | Public/private markers across lock and account switch | No new exposure to the stated unintended reader |

Use [federation and token trust](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/federation-token-trust.html) and [authenticator lifecycle](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/authenticator-lifecycle.html) for the shared server-side procedures. Native-specific continuations are in [Android components](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/android-components.html) and [iOS boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/ios-boundaries.html); use [client storage and privacy](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/client-storage-transport.html) for notifications, snapshots, clipboard and metadata-only hypotheses. RFC 8252 establishes the native external-agent/PKCE model, while Android distinguishes the client, credential provider and verifying server. [Native OAuth](https://www.rfc-editor.org/rfc/rfc8252), [Credential Manager](https://developer.android.com/identity/credential-manager).

- [ ] Record the final authenticated account or actual key operation.
- [ ] Repeat with an untouched eligible build after tracing.
- [ ] Distinguish the OS authorization screen from backend validation.

## Sources


All sources accessed **2026-09-11**. “Undated” means no reliable publication/update date was established from the retrieved page. Dates are page metadata, not a guarantee of completeness for every current OS version. Archived Apple sources are used for established mechanisms and command syntax, not blanket claims about current platform enforcement.

| ID | Publisher / exact source | Date | Use |
|---|---|---|---|
| MD01 | OWASP, [OWASP MASVS](https://mas.owasp.org/MASVS/) | Undated; living standard | Mobile control organization |
| MD02 | OWASP, [OWASP MASTG](https://mas.owasp.org/MASTG/) | Undated; living guide | Testing methodology and technique catalog |
| MD03 | OWASP, [Mobile Application Security Weakness Enumeration](https://mas.owasp.org/MASWE/) | Undated; living catalog | Weakness taxonomy and version caution |
| MD04 | Google, [Android Debug Bridge](https://developer.android.com/tools/adb) | Updated 2026-09-02 | Device/package inspection commands |
| MD05 | Google, [apkanalyzer](https://developer.android.com/tools/apkanalyzer) | Updated 2026-03-05 | APK metadata and manifest CLI |
| MD06 | Google, [apksigner](https://developer.android.com/tools/apksigner) | Updated 2026-03-05 | APK certificate/signature inspection |
| MD07 | Google, [android:exported](https://developer.android.com/privacy-and-security/risks/android-exported) | 2024-09-24, indexed page date | Component exposure and version dependence |
| MD08 | Google, [Unsafe use of deep links](https://developer.android.com/privacy-and-security/risks/unsafe-use-of-deeplinks) | 2024-10-24, indexed page date | Deep-link validation |
| MD09 | Google, [WebView – Native bridges](https://developer.android.com/privacy-and-security/risks/insecure-webview-native-bridges) | Updated 2024-10-15 | Frames, native bridges, origin boundaries |
| MD10 | Google, [Network security configuration](https://developer.android.com/privacy-and-security/security-config) | Updated 2026-08-28 | Trust anchors and debug overrides |
| MD11 | Google, [Content provider basics](https://developer.android.com/guide/topics/providers/content-provider-basics) | Undated in this registry | Provider access model |
| MD12 | skylot/JADX maintainers, [JADX repository and CLI](https://github.com/skylot/jadx) | Undated; living README | Decompiler usage and limitations |
| MD13 | Apktool maintainers, [CLI Parameters](https://apktool.org/docs/cli-parameters/) | Undated | Local package decoding |
| MD14 | OWASP, [iOS Security Testing](https://mas.owasp.org/MASTG/0x06b-iOS-Security-Testing/) | Undated | iOS lab/platform distinctions |
| MD15 | Apple, [Keychain data protection](https://support.apple.com/guide/security/keychain-data-protection-secb0694df1a/web) | Published 2024-12-19 | Access groups, classes, authentication constraints |
| MD16 | Apple, [Support Universal Links](https://developer.apple.com/library/archive/documentation/General/Conceptual/AppSearch/UniversalLinks.html) | Updated 2016-12-15; archived | App/website association model |
| MD17 | OWASP, [MASTG-TOOL-0062: Plutil](https://mas.owasp.org/MASTG/tools/ios/MASTG-TOOL-0062/) | Undated | Property-list inspection tooling |
| MD18 | OWASP, [MASTG-TECH-0111: Extracting Entitlements from MachO Binaries](https://mas.owasp.org/MASTG/techniques/ios/MASTG-TECH-0111/) | Undated | Signing/entitlement inspection |
| MD19 | Apple, [TN2206: macOS Code Signing In Depth](https://developer.apple.com/library/archive/technotes/tn2206/_index.html) | Page updated 2016-09-13; archived | Signature verification command and boundaries |
| MD20 | Microsoft / Mark Russinovich, [Process Monitor](https://learn.microsoft.com/en-us/sysinternals/downloads/procmon) | Published 2026-09-10 | Local process, registry, filesystem observation |
| MD21 | Microsoft, [Get-AuthenticodeSignature](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-authenticodesignature?view=powershell-7.5) | Undated; PowerShell 7.5 documentation | Windows signature inspection |
| MD22 | Microsoft, [icacls](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/icacls) | Updated 2025-06-09 | Windows ACL inspection |
| MD23 | OpenJS Foundation / Electron contributors, [Security](https://www.electronjs.org/docs/latest/tutorial/security) | Undated; living documentation | Renderer, navigation, IPC boundaries |
| MD24 | Electron contributors, [Context Isolation](https://www.electronjs.org/docs/latest/tutorial/context-isolation) | Undated | Bridge limitations and API exposure |
| MD25 | Google, [Stay secure](https://developer.chrome.com/docs/extensions/develop/security-privacy/stay-secure) | Page states updated 2018-03-06 | Extension permissions and untrusted messages |
| MD26 | Google, [Message passing](https://developer.chrome.com/docs/extensions/develop/concepts/messaging) | Page states updated 2025-12-03 | Extension messaging contexts |
| MD27 | Google, [Native messaging](https://developer.chrome.com/docs/extensions/develop/concepts/native-messaging) | Page states updated 2023-02-27 | Native host manifest and execution boundary |
| MD28 | AFL++ maintainers, [Fuzzing in Depth](https://aflplus.plus/docs/fuzzing_in_depth/) | Undated; living guide | Harness, corpus, execution, resource limits |
| MD29 | GNU Binutils / Sourceware, [readelf](https://sourceware.org/binutils/docs/binutils/readelf.html) | Undated | Non-executing ELF metadata inspection |


## Shared investigation procedures

- [Object, function, and property authorization](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/authz-matrix.html) — Turn identities, tenants, objects, roles, and lifecycle transitions into a reproducible permission matrix.
- [Authentication, recovery, federation, and session lifecycle](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/identity-session.html) — Test registration, recovery, identity changes, invitations, SSO enforcement, and deprovisioning as one account state machine.
- [Trace input into queries, commands, and templates](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/injection-tracing.html) — Prove interpretation at a specific sink using small paired experiments instead of payload spraying.
- [Browser execution, cross-origin reads, and forged actions](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/browser-trust.html) — Use real browser behavior to distinguish XSS, CSRF, CORS, and messaging failures from header-only leads.
- [Uploads, downloads, paths, archives, and XML](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/file-boundaries.html) — Follow a file through acceptance, storage, processing, publication, and retrieval while preserving ownership and path boundaries.
- [Workflow invariants, replay, idempotency, and races](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/state-business-logic.html) — Find security consequences in workflow ordering and concurrency, with serial controls and durable-state evidence.
- [REST, GraphQL, gRPC, WebSocket, and SSE permission parity](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/api-protocols.html) — Carry the same permission invariant across protocols, nested fields, streams, and alternate API versions.
- [Source review: entry point to protected operation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/source-dataflow.html) — Trace attacker control and authorization through handlers, services, queues, and sensitive operations; promote only reachable violations of a stated invariant.
- [CI and releases: trace untrusted input into privileged work](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/supply-chain-ci.html) — Audit workflow events, shell interpolation, untrusted builds, artifact consumers, and release identity as one privilege chain.
- [Dependencies: from advisory match to reachable impact](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/dependency-reachability.html) — Separate composition, advisory matching, runtime reachability, and exploit prerequisites so dependency reports describe product impact.
- [Libraries and parsers: bounded fuzzing to a minimal reproducer](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/parser-fuzzing.html) — Build a realistic local harness, instrument the target, bound fuzzing resources, and turn unique faults into defensible library or consumer reports.
- [Android components, intents and deep links](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/android-components.html) — Trace ordinary-app inputs through exported components, URI grants and links to one protected operation.
- [iOS signing capabilities, links and protected data](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/ios-boundaries.html) — Connect entitlements and application groups to actual callers, URL transitions and protected key use.
- [Client storage, logs, backup and transport trust](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/client-storage-transport.html) — Measure where sensitive client state goes, who can retrieve it, and whether transport rejects invalid peers.
- [Update signatures, rollback and privileged installation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/update-integrity.html) — Test the update decision and installation boundary while preserving production signer and privilege assumptions.
- [MFA and passkeys: enrollment, proof, replacement, and recovery](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/authenticator-lifecycle.html) — Follow each authenticator from account binding to removal, and validate WebAuthn assertions without mistaking client UI or counter behavior for a security guarantee.
- [OAuth, OIDC, and SAML: transaction binding and token trust](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/federation-token-trust.html) — Separate browser transaction binding, issuer trust, token purpose, and identity linking using controlled federation fixtures.

## Vulnerability reference

- [Broken object-level authorization (BOLA / IDOR)](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/bola-controlled-object-access.html)
- [Broken function-level authorization (BFLA)](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/bfla-restricted-function.html)
- [Broken property authorization: private response fields](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/bopla-private-response-property.html)
- [Mass assignment of server-controlled properties](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/mass-assignment-protected-property.html)
- [Authentication or MFA state bypass](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/authentication-incomplete-state-bypass.html)
- [Session fixation across login](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/session-fixation-login-binding.html)
- [Residual access after explicit session revocation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/session-revocation-residual-access.html)
- [Password reset binding or single-use failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/password-reset-account-binding.html)
- [OAuth login or account-linking confusion](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/oauth-login-account-linking-confusion.html)
- [JWT signature, issuer, audience, or token-purpose validation failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/jwt-signature-trust-failure.html)
- [SQL injection](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/sql-query-structure-injection.html)
- [NoSQL operator or query injection](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/nosql-operator-contract-bypass.html)
- [Reflected or stored cross-site scripting](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/xss-reflected-stored-origin-execution.html)
- [DOM-based cross-site scripting](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/dom-xss-source-sink-flow.html)
- [Cross-site request forgery (CSRF)](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/csrf-browser-forged-state-change.html)
- [CORS private-data exposure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/cors-private-credentialed-read.html)
- [Cross-origin messaging trust failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/postmessage-origin-validation.html)
- [Unsafe upload interpretation or placement](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/unsafe-upload-interpretation.html)
- [Path traversal outside an allowed root](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/path-traversal-controlled-canary.html)
- [XML external entity injection (XXE)](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/xxe-external-entity-resolution.html)
- [Race condition in a security-sensitive transition](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/race-condition-duplicate-transition.html)
- [Workflow order or approval bypass](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/workflow-order-validation-bypass.html)
- [Single-use action or idempotency replay failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/single-use-idempotency-replay.html)
- [GraphQL resolver or field authorization failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/graphql-resolver-field-authz.html)
- [WebSocket message or subscription authorization failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/websocket-message-authorization.html)
- [Cross-site WebSocket hijacking](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/cross-site-websocket-hijacking.html)
- [Hard-coded product credentials](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/hardcoded-credentials.html)
- [CI artifact poisoning across a workflow trust boundary](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/ci-artifact-poisoning.html)
- [Dependency confusion and unintended package origin](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/dependency-confusion.html)
- [Unsafe object deserialization](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/unsafe-deserialization.html)
- [Out-of-bounds memory read](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/out-of-bounds-read.html)
- [Out-of-bounds memory write](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/out-of-bounds-write.html)
- [Use after free in a public API or parser lifecycle](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/use-after-free.html)
- [Integer overflow affecting allocation or bounds](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/integer-overflow.html)
- [Parser resource exhaustion and decompression amplification](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/parser-resource-exhaustion.html)
- [Regular-expression denial of service](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/regex-dos.html)
- [Predictable temporary files and unsafe creation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/insecure-temporary-files.html)
- [Exported Android component exposes a protected operation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/android-exported-operation.html)
- [Content-provider permission or URI-grant escape](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/android-provider-grant.html)
- [Nested intent redirects application authority](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/android-intent-redirection.html)
- [PendingIntent grants unintended mutable or replayable authority](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/android-pendingintent-delegation.html)
- [Mobile link handler trusts routing as authorization](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/mobile-link-handler.html)
- [Untrusted WebView content reaches a native bridge](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/mobile-webview-native-bridge.html)
- [Keychain accessibility violates the intended lock boundary](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/ios-keychain-access-policy.html)
- [Extension input crosses an iOS shared-container boundary](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/ios-shared-container-trust.html)
- [Local authentication does not gate the protected operation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/client-local-auth-gate.html)
- [Backup or transfer exposes unintended sensitive client state](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/client-backup-sensitive-state.html)
- [Sensitive client state leaks through accessible diagnostics](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/client-secret-logging.html)
- [TLS peer certificate or hostname verification failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/client-invalid-certificate.html)
- [Updater accepts an artifact outside its publisher trust policy](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/update-untrusted-artifact.html)
- [Attacker-controlled rollback restores a prohibited security state](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/update-security-rollback.html)
- [Open redirect across an origin trust boundary](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/open-redirect-trust.html)
- [Predictable security token or capability identifier](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/weak-security-token-randomness.html)
- [Password storage without an adequate adaptive hash](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/password-storage-weak-hash.html)
- [Encrypted data accepted without integrity authentication](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/crypto-authentication-missing.html)
- [Unauthorized authenticator enrollment, replacement, or removal](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/authenticator-management-proof-bypass.html)
- [WebAuthn assertion accepted for an invalid account or ceremony context](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/webauthn-assertion-binding-failure.html)
- [Verification or account merge preserves another actor's access](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/identity-verification-merge-confusion.html)
- [Enforced SSO bypass through an alternate login path](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/enforced-sso-alternate-login-bypass.html)
- [Private client content leaks through a lower-trust display or sharing channel](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/client-private-ui-disclosure.html)