# OSS repositories and self-hosted products

Repository hunting succeeds when source access becomes a reproducible explanation of an attacker crossing a security boundary. An unsafe function, dependency advisory, or permissive setting is a lead. A strong report connects an eligible released version, attacker-controlled input, reachable behavior, missing control, and observable impact. Audit the application and the machinery that builds and distributes it as two connected attack surfaces.

## Choose the correct research route

| Route | Establish before investing | Useful deliverable |
|---|---|---|
| OSS product with a bounty | Exact repository, branches/releases, supported configurations, eligible vulnerability classes, disclosure channel, and current reward rules | Local reproduction on an eligible release with product-level impact |
| OSS project accepting disclosure | `SECURITY.md`, private reporting availability, supported versions, maintainer contact | Coordinated vulnerability report; payment is not implied |
| Vendor-hosted service with public source | Whether the repository and live service are separately in scope; deployed-version uncertainty | Source-supported hypothesis, followed only by permitted service testing |
| Self-hosted deployment in an authorized program | Deployment owner, deployment-specific scope, edition, settings, plugins, and versions | Finding against that deployment with product/configuration attribution |
| Private source-assisted assessment | Permission to possess and process code, approved tooling/storage, branches, environments, third-party exclusions | Evidence retained within the agreed confidentiality boundary |
| Library, SDK, parser, CLI, or agent | Supported consumers, caller contract, attacker-controlled inputs, local versus remote impact | Minimal consumer/harness demonstrating the violated contract |

A public repository does not extend a program's scope to its maintainers' infrastructure, package registries, customers, or public deployments. A locally reproduced product vulnerability does not establish that every deployed instance is affected. If payment matters, capture the current program's eligibility terms before starting; a CVE and a bounty are separate outcomes. GitHub offers private vulnerability reporting only where maintainers enable it, and repository advisories support private discussion and fixes. [GitHub: private reporting](https://docs.github.com/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability), [repository advisories](https://docs.github.com/code-security/security-advisories/repository-security-advisories/about-repository-security-advisories).

## Staged playbook

The following gates are recommended operating criteria, not platform-imposed requirements.

| Stage | Inputs and actions | Evidence | Exit gate |
|---|---|---|---|
| 1. Qualify | Read policy, supported versions, prior advisories, release notes, architecture, installation requirements | Scope snapshot, repository identity, likely audit themes | An eligible version and confidential reporting route exist |
| 2. Freeze | Preserve commit SHA, release tag, lockfiles, submodules, image digests, tool versions | Reproduction manifest and source inventory | Another researcher can identify the same inputs |
| 3. Build the lab | Review build scripts; install in a disposable VM; create synthetic users, tenants, data, and dependencies | Clean snapshot, config delta, health check, reset procedure | Normal workflows work and unintended egress is blocked |
| 4. Map | Trace entry points, authentication, authorization, queues, storage, integrations, and deployment boundaries | Data-flow map and role/resource matrix | Each priority feature has a known entry and protected operation |
| 5. Form hypotheses | Combine manual review, local scans, advisory review, and changed-code inspection | Ranked hypotheses with source paths and required assumptions | Each candidate states a falsifiable security invariant |
| 6. Validate | Exercise the smallest synthetic case; inspect call path; compare an authorized control | Sanitized requests, outputs, trace, before/after state | Impact reproduces without changing unrelated security controls |
| 7. Audit delivery | Review dependency, build, workflow, package, image, and IaC paths | Separate reachability and privilege chains | Supply-chain claims have a concrete consumer or privileged sink |
| 8. Report and retest | Minimize reproduction, bound versions, suggest fix, privately submit, retest patch | Report package and updated validation matrix | Recipient can reproduce; remaining assumptions are explicit |

## Reproducible lab design

Treat unfamiliar repositories and their dependency installation as executable input. Review Dockerfiles, Compose, Makefiles, lifecycle scripts, build backends, development-container settings, and CI scripts before invoking them. Use a disposable VM for untrusted builds; containers within it help reproduce services but are not a reason to expose the host Docker socket, SSH agent, cloud credentials, or personal home directory.

Separate the preparation phase, where reviewed dependencies and databases are downloaded, from the test phase. Bind application ports to loopback. Create synthetic tenant A and B, ordinary and privileged accounts, a local mail catcher, and local callback/file-storage services. Block external egress during exploit validation; replace integrations with controlled fixtures. Preserve a working baseline before modifying configuration.

Record environment differences explicitly: community versus enterprise edition, reverse proxy behavior, authentication mode, enabled plugins, database backend, OS/architecture, and documented deployment topology. An attack that depends on `DEBUG`, disabled authentication, or a deliberately exposed administrator interface has different prerequisites from one affecting the supported production setup. A dangerous default or documented deployment recipe can be a legitimate product issue; demonstrate the actual boundary and check program policy.

## Application and source audit

Start with business capabilities, then inspect implementation. OWASP emphasizes manual review for application logic, data flows, and contextual flaws that automated tools can miss. Use scanning to prioritize code; manually establish the security argument. [OWASP: Secure Code Review](https://cheatsheetseries.owasp.org/cheatsheets/Secure_Code_Review_Cheat_Sheet.html).

For each feature, write one invariant: “a project member can retrieve documents only from projects they belong to,” or “an import cannot create files outside its assigned directory.” Trace both forward from attacker-controlled inputs and backward from sensitive operations. The intersection is your candidate path.

| Area | Trace precisely | Proof target |
|---|---|---|
| Authentication | Login, password reset, invitations, SSO callbacks, token issuance/refresh, revocation | A synthetic principal acquires or retains an unintended identity/session |
| Object/tenant authorization | Route → actor resolution → queryset/service → object → tenant/role check | Account A accesses a fixture owned by B through the real handler |
| Privileged actions | UI restriction versus server policy; API variants, bulk endpoints, background jobs | A lower role performs an operation reserved for a higher role |
| Injection | Input parsing → transformations → ORM/raw query, process, template, evaluator, interpreter | Input changes interpretation at the sink under supported conditions |
| Files and archives | Upload name/content → normalization → extraction → symlink handling → persistence → serving | A synthetic file crosses an intended path or content boundary |
| Outbound requests | URL parsing → scheme/host validation → DNS/redirect handling → fetch → response exposure | The application reaches a blocked local fixture or returns prohibited fixture content |
| Asynchronous work | Job creation → serialized actor/context → queue → worker → retry | A worker loses the initiating user's authorization context or repeats a protected effect |
| Concurrency | Read/check/write sequence, transaction boundaries, locks, uniqueness, idempotency | Two bounded local operations violate an explicit invariant |
| Extensions and AI features | Plugin/tool selection, retrieval ownership, instruction/data boundary, delegated credentials | Lower-trust content causes a demonstrably unauthorized tool or data action |

**Authentication and authorization require separate proofs.** A valid JWT says little about whether a user owns the requested object. Check where tenant identity originates, whether membership is current, whether query scoping survives joins and bulk operations, and whether subsequent service calls replace validated identifiers. Inspect alternate endpoints, download URLs, exports, websocket handlers, and scheduled tasks that share the same service.

**Taint analysis is a model.** Define sources, propagators, sanitizers, and sinks for the actual framework and wrappers. A sanitizer is valid only for the destination context; HTML escaping does not establish filesystem containment. An authorization guard is not equivalent to value sanitization. Validate your rule against a vulnerable fixture and a safe sibling. Semgrep documents these modeling components; its CE analysis does not provide every interprocedural/interfile capability available in paid engines. [Semgrep: taint analysis](https://docs.semgrep.dev/writing-rules/data-flow/taint-mode/overview), [CLI capabilities](https://docs.semgrep.dev/cli-reference).

**Reachability is the decisive filter.** Record the entry point, attacker role, call sequence, feature flag, build inclusion, configuration, and guard outcomes. Dead code, administrator-only extension loading, a debug-only helper, and a low-privilege production route are different findings. A negative scanner result is not proof that a route is safe. For dynamic dispatch, generated code, reflection, framework magic, or runtime plugin resolution, explain what static analysis did not cover.

**Prove the real execution path.** A unit-level demonstration that calls an internal helper directly may bypass the very authorization check being assessed. Begin with the supported application interface when claiming application impact. Use instrumentation to explain the path, but reproduce again with security behavior unchanged. Keep the authorized control case beside the failing case.

## Dependencies, secrets, and delivery infrastructure

Give this work its own review pass. Application SAST does not examine who can alter a release, which registry supplies dependencies, or whether a worker image contains additional vulnerable components.

### Dependencies and packaged artifacts

Build separate inventories for source/lockfiles, installed runtime dependencies, build/test tooling, and final images or release archives. Record package ecosystem, name, resolved version, origin, direct/transitive relationship, and shipped artifact. An SBOM records composition; a vulnerability matcher associates known advisories. Neither alone proves exploitability. Syft generates SBOMs; OSV-Scanner extracts package information and matches it against vulnerability records. [Syft](https://github.com/anchore/syft), [OSV-Scanner usage](https://google.github.io/osv-scanner/usage/).

For each advisory, establish: affected version range, relevant API or feature, application call path, attacker-controlled argument, necessary configuration, deployed inclusion, and security impact. Check distro backports and vendored modifications. A package in a development dependency may affect the build pipeline without shipping in the application; keep those impact stories separate. Avoid submitting “old package version” when the program requires a demonstrated vulnerable use.

For dependency confusion, inspect scoped registry mappings, fallback behavior, namespace ownership, lockfile integrity, URL dependencies, install hooks, and privileged build context. Reproduce resolution behavior using a local registry and synthetic package names. Do not claim real package names, publish to public registries, or trigger target builds as an assumed extension of repository scope.

### Secrets

Inspect the working tree and available Git history separately, including release archives and readable build configuration. Classify a finding as fixture, public identifier, non-secret material, or plausible credential. Preserve the file path, commit, secret type, relevant context, and a redacted fingerprint. Ask the owner to validate and rotate plausible exposed credentials; do not log in with them or call provider validation endpoints. Gitleaks' modern interfaces are `git`, `dir`, and `stdin`; `detect` and `protect` are deprecated. Redaction is not a substitute for reviewing exported evidence. [Gitleaks official documentation](https://github.com/gitleaks/gitleaks).

### CI/CD and GitHub Actions

For each workflow, trace **event actor → attacker-controlled data/code → executed step → token/environment privilege → release or deployment effect**. Enumerate workflow triggers, reusable workflows, local/composite actions, shell interpolation, downloaded artifacts, cache consumers, package-install hooks, credentials, runner isolation, and deployment approvals. Review the action implementation at the pinned revision. GitHub recommends minimum token permissions and immutable commit-SHA action references. [GitHub: secure use](https://docs.github.com/en/actions/reference/security/secure-use).

`pull_request_target` or `workflow_run` is a review signal, not a complete vulnerability. Determine whether untrusted code or artifacts are actually executed and which privileges are available. Current GitHub documentation describes checkout protections and cache restrictions for `pull_request_target`; inspect the exact action revision, explicit opt-outs, repository settings, and observed behavior instead of assuming older examples still reproduce. Use a private/local fixture with inert marker output and dummy credentials; request a maintainer-assisted run if real workflow behavior is necessary. [GitHub: event semantics](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows), [securely using pull_request_target](https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target).

### Registries, signing, images, and IaC

Map repository permissions to release tags, build inputs, artifacts, registry publishing, and deployment identities. Examine whether untrusted material can enter after review or before signing. Verify provenance against the expected source and builder; authenticated provenance does not prove application correctness. For OIDC, inspect issuer, audience, repository/workflow identity, branch/environment conditions, and the actual role permissions. GitHub's AWS guidance specifically calls for evaluation of the token subject to restrict trusted workflows. [GitHub: OIDC in AWS](https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-aws).

Trusted publishing removes reliance on long-lived publish credentials, but its security depends on the configured trusted workflow. Inspect publisher settings and legacy token fallback instead of treating an OIDC badge as sufficient. npm documents workflow identity restrictions; PyPI explicitly analyzes how compromised workflows can affect trusted publishers. [npm: trusted publishing](https://docs.npmjs.com/trusted-publishers/), [PyPI: security model](https://docs.pypi.org/trusted-publishers/security-model/).

Compare the final image with source expectations: inherited packages, copied secrets, build layers, entrypoint privilege, capabilities, host mounts, and update mechanism. Review IaC defaults, exposed services, wildcard IAM, cross-tenant storage, secret injection, and metadata-service assumptions. A scanner's root-user or wildcard-policy finding becomes a bounty candidate only when it violates an applicable security expectation with defensible impact. Preserve the relevant rendered configuration rather than reporting a template variable whose deployed value is unknown.

## Parsers, native code, and fuzzing

Choose a narrow parser or state transition with realistic attacker input. First reproduce normal usage through its public API. Build an in-process harness that resets state, bounds input size, avoids network/disk side effects, and instruments relevant code. Seed it with a small representative corpus, add format dictionaries when useful, and use ASan/UBSan where appropriate. Track coverage growth, unique root causes, and minimized reproducers rather than raw crash totals. LLVM documents libFuzzer corpus handling, runtime/resource bounds, and crash minimization. [LLVM: libFuzzer](https://llvm.org/docs/LibFuzzer.html).

Confirm that a crash belongs to the target rather than your harness. Reproduce on the eligible build, minimize the input, deduplicate by root cause, and identify whether the outcome is memory corruption, bounded parsing failure, or resource exhaustion. State remote/local exposure through a real consumer. Do not convert a local crash into an unsupported remote-code-execution claim; do not fuzz live shared services under this local workflow.

## Patch analysis, reporting, and CVEs

Read security patches to identify the invariant being restored, then inspect equivalent call sites, alternate encodings, older supported branches, and duplicated helpers. Patch-diff work is valuable for learning and identifying incomplete fixes; reproducing an already-disclosed issue may be ineligible or duplicate. Record which version introduced the flaw, which tested versions remain affected, and which patch actually prevents the behavior.

A report package should contain the exact source revision and product version, supported setup, minimal configuration delta, attacker role, reproduction steps, expected/actual results, root-cause path, affected-version evidence, demonstrated impact, and a focused remediation suggestion. Provide synthetic fixture data and a minimal local PoC. For retesting, compare the vulnerable case, authorized behavior, and a nearby variant; report remaining uncertainty instead of extrapolating a version range.

Use the private channel specified by the program or maintainers. Coordinate an advisory and disclosure timing. GitHub allows maintainers to request a CVE within the repository advisory workflow when they do not already have one; requesting an identifier is separate from proving eligibility or earning payment. [GitHub: publishing advisories and requesting a CVE](https://docs.github.com/code-security/security-advisories/working-with-repository-security-advisories/publishing-a-repository-security-advisory).

## Local command cheat sheet

Examples target only an existing local `./repo`; they have not been executed against a target. Create `./evidence` first and keep it outside the scan root. Preinstall pinned tool versions, inspect inherited configurations, and prepare required rules/databases/packs in a separate connected preparation phase. Run private-code analysis with network egress blocked. Scanner exit codes can represent findings or execution failures; preserve stderr and classify the outcome before interpreting the report.

**1. Freeze the source identity.** [Git reference](https://git-scm.com/docs/git-rev-parse).

```bash
git -C ./repo rev-parse --verify HEAD > ./evidence/commit.txt
```

**2. Inventory source and hidden configuration without reading Git objects.** [ripgrep guide](https://github.com/BurntSushi/ripgrep/blob/master/GUIDE.md).

```bash
rg --files --hidden -g '!.git' ./repo > ./evidence/files.txt
```

**3. Run reviewed local Semgrep rules.** No registry rules are fetched by this command. [Semgrep CLI](https://docs.semgrep.dev/cli-reference).

```bash
semgrep scan --oss-only --config ./rules --metrics=off \
  --disable-version-check --sarif \
  --output ./evidence/semgrep.sarif ./repo
```

The CE engine uses LGPL-2.1; Semgrep-maintained registry rules have a separate Semgrep Rules License, and third-party rules have their own licenses. Internal research and embedding rules into a commercial scanning service are different uses. Prefer original local rules or rules whose terms fit the intended use. [Semgrep licensing](https://docs.semgrep.dev/licensing), [Rules License](https://semgrep.dev/legal/rules-license/).

**4. Review local Git history for secrets.** A shallow clone limits historical coverage. Inspect the output before sharing. [Gitleaks](https://github.com/gitleaks/gitleaks).

```bash
gitleaks git ./repo --redact=100 --report-format json \
  --report-path ./evidence/gitleaks.json
```

**5. Inventory local packages.** [Syft output formats](https://oss.anchore.com/docs/guides/sbom/formats/).

```bash
syft dir:./repo -o cyclonedx-json=./evidence/sbom.cdx.json
```

**6. Match dependencies using previously cached OSV ecosystem databases.** Full `--offline` prevents network use; `--offline-vulnerabilities` alone still permits other network features. Offline mode lacks commit-level matching. [OSV source scanning](https://google.github.io/osv-scanner/usage/scan-source), [offline mode](https://google.github.io/osv-scanner/usage/offline-mode/).

```bash
osv-scanner scan source --offline -r --format json \
  ./repo > ./evidence/osv.json
```

**7. Inspect dependencies and IaC with prepared Trivy databases/checks.** These flags independently disable online resolution, updates, notices, and telemetry. Missing caches or unsupported flags on older releases require preparation/version correction, not silent fallback to online scanning. [Trivy filesystem CLI](https://trivy.dev/docs/latest/references/configuration/cli/trivy_filesystem/).

```bash
trivy fs --scanners vuln,misconfig --offline-scan \
  --skip-db-update --skip-java-db-update --skip-check-update \
  --skip-version-check --disable-telemetry \
  --format json --output ./evidence/trivy.json ./repo
```

**8. Create and query a Python CodeQL database.** Requires a prepared local query suite and its dependencies; language/build setup differs for other projects. [Database preparation](https://docs.github.com/en/code-security/tutorials/customize-code-scanning/prepare-code-for-analysis), [analysis](https://docs.github.com/en/code-security/tutorials/customize-code-scanning/analyze-code).

```bash
codeql database create ./evidence/codeql-python \
  --language=python --source-root=./repo
codeql database analyze ./evidence/codeql-python \
  ./queries/python-security.qls --format=sarif-latest \
  --output=./evidence/codeql.sarif
```

CodeQL is free for public repositories under its terms. Private organization repositories require the applicable GitHub plan and GitHub Code Security license; possession of source does not grant unrestricted CodeQL use. The query libraries' open-source license does not replace the CLI terms. [GitHub: CodeQL availability and license](https://docs.github.com/en/code-security/concepts/code-scanning/codeql/codeql-cli).

## Exit checklist

- [ ] Repository, product edition, version, scope, and reporting channel recorded.
- [ ] Working baseline, synthetic identities, reset procedure, and config delta preserved.
- [ ] Priority entry points mapped to authentication, authorization, and sensitive operations.
- [ ] Every promoted finding has attacker control, reachability, prerequisites, and impact evidence.
- [ ] Source, runtime, build, and shipped dependency inventories distinguished.
- [ ] Secrets redacted; no discovered credential used for verification.
- [ ] CI events, artifact/cache consumers, publishing identity, images, and IaC reviewed.
- [ ] Scanner errors, excluded files, stale databases, and unresolved models recorded.
- [ ] Local PoC minimizes side effects and includes a legitimate control case.
- [ ] Prior advisories checked; tested versions distinguished from inferred versions.
- [ ] Report and patch retest can be reproduced from preserved inputs.

## GitLab and provider-specific CI branches

The shared release audit applies to GitLab, but GitHub event names and defaults do not transfer directly. Use [GitLab pipeline boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/gitlab-pipeline-boundaries.html) to trace the configuration revision, execution project, trigger actor, protected resources, job tokens, downstream inputs and runner state. Keep these three identities separate in the report; a merge request does not by itself prove execution with parent-project authority.

For jobs that deploy into Azure or GCP, continue through [provider-specific identity and storage boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/azure-gcp-boundaries.html). Record the exact token-to-cloud-principal binding and final synthetic resource operation. A cloud login inside a CI job is one edge in the chain, not a complete release or tenant-isolation proof.

## Source registry

All sources were accessed on **2026-09-11**. Unless a date is listed, the cited documentation is undated/living documentation; tool and service behavior must be checked again when used.

| Publisher | Source | Publication/update date | Supports |
|---|---|---|---|
| OWASP | [Secure Code Review](https://cheatsheetseries.owasp.org/cheatsheets/Secure_Code_Review_Cheat_Sheet.html) | Undated | Manual review, logic/data-flow emphasis |
| GitHub | [Privately reporting a vulnerability](https://docs.github.com/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability) | Undated | Private reporting availability |
| GitHub | [Repository security advisories](https://docs.github.com/code-security/security-advisories/repository-security-advisories/about-repository-security-advisories) | Undated | Private collaboration/disclosure |
| GitHub | [Publishing an advisory](https://docs.github.com/code-security/security-advisories/working-with-repository-security-advisories/publishing-a-repository-security-advisory) | Undated | CVE request workflow |
| Semgrep | [Taint analysis](https://docs.semgrep.dev/writing-rules/data-flow/taint-mode/overview) | Undated | Sources, sinks, propagators, sanitizers |
| Semgrep | [CLI reference](https://docs.semgrep.dev/cli-reference) | Undated | Local rules, flags, engine capabilities |
| Semgrep | [Licensing](https://docs.semgrep.dev/licensing) and [Rules License](https://semgrep.dev/legal/rules-license/) | Undated | CE and rule licensing distinctions |
| Gitleaks maintainers | [Official repository documentation](https://github.com/gitleaks/gitleaks) | Undated | Current commands, history, redaction |
| Anchore | [Syft](https://github.com/anchore/syft) and [output formats](https://oss.anchore.com/docs/guides/sbom/formats/) | Undated | SBOM inventory and output syntax |
| Google | [OSV usage](https://google.github.io/osv-scanner/usage/), [source scanning](https://google.github.io/osv-scanner/usage/scan-source), [offline mode](https://google.github.io/osv-scanner/usage/offline-mode/) | Undated | Version matching, recursion, offline limits |
| Aqua Security | [Trivy filesystem reference](https://trivy.dev/docs/latest/references/configuration/cli/trivy_filesystem/) | Undated | Scanners and individual offline/update flags |
| GitHub | [Secure use reference](https://docs.github.com/en/actions/reference/security/secure-use) | Undated | Least privilege, immutable action references |
| GitHub | [Workflow events](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows) and [pull_request_target guidance](https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target) | Undated | Event trust boundaries and current protections |
| GitHub | [OIDC in AWS](https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-aws) | Undated | Subject/identity restrictions |
| npm | [Trusted publishing](https://docs.npmjs.com/trusted-publishers/) | Updated 2026-09-03 | Publisher identity and authentication |
| Python Package Index | [Trusted publisher security model](https://docs.pypi.org/trusted-publishers/security-model/) | Undated | Workflow compromise and publishing trust |
| LLVM Project | [libFuzzer](https://llvm.org/docs/LibFuzzer.html) | Undated | Harness, corpus, bounds, minimization |
| GitHub | [CodeQL CLI](https://docs.github.com/en/code-security/concepts/code-scanning/codeql/codeql-cli), [database preparation](https://docs.github.com/en/code-security/tutorials/customize-code-scanning/prepare-code-for-analysis), [analysis](https://docs.github.com/en/code-security/tutorials/customize-code-scanning/analyze-code) | Undated | Eligibility and local CLI workflow |
| Git Project | [git-rev-parse](https://git-scm.com/docs/git-rev-parse) | Undated | Commit identity command |
| Andrew Gallant/ripgrep contributors | [ripgrep guide](https://github.com/BurntSushi/ripgrep/blob/master/GUIDE.md) | Undated | Local file inventory flags |


## Shared investigation procedures

- [Object, function, and property authorization](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/authz-matrix.html) — Turn identities, tenants, objects, roles, and lifecycle transitions into a reproducible permission matrix.
- [Authentication, recovery, federation, and session lifecycle](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/identity-session.html) — Test registration, recovery, identity changes, invitations, SSO enforcement, and deprovisioning as one account state machine.
- [Trace input into queries, commands, and templates](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/injection-tracing.html) — Prove interpretation at a specific sink using small paired experiments instead of payload spraying.
- [Server-side fetching and network trust boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/ssrf-boundary.html) — Separate an intended fetch from a request that reaches a prohibited destination, forwards authority, or exposes a protected response.
- [Browser execution, cross-origin reads, and forged actions](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/browser-trust.html) — Use real browser behavior to distinguish XSS, CSRF, CORS, and messaging failures from header-only leads.
- [Uploads, downloads, paths, archives, and XML](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/file-boundaries.html) — Follow a file through acceptance, storage, processing, publication, and retrieval while preserving ownership and path boundaries.
- [Workflow invariants, replay, idempotency, and races](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/state-business-logic.html) — Find security consequences in workflow ordering and concurrency, with serial controls and durable-state evidence.
- [REST, GraphQL, gRPC, WebSocket, and SSE permission parity](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/api-protocols.html) — Carry the same permission invariant across protocols, nested fields, streams, and alternate API versions.
- [Proxy normalization, cache isolation, and request boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/proxy-cache.html) — Investigate layered HTTP behavior with isolated cache keys and controlled front-end/back-end traffic.
- [OSS lab: pin, install, prove, reset](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/oss-lab-reproduction.html) — Turn an eligible release into a repeatable synthetic environment with preserved versions, realistic controls, and an explicit reset recipe.
- [Source review: entry point to protected operation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/source-dataflow.html) — Trace attacker control and authorization through handlers, services, queues, and sensitive operations; promote only reachable violations of a stated invariant.
- [CI and releases: trace untrusted input into privileged work](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/supply-chain-ci.html) — Audit workflow events, shell interpolation, untrusted builds, artifact consumers, and release identity as one privilege chain.
- [Dependencies: from advisory match to reachable impact](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/dependency-reachability.html) — Separate composition, advisory matching, runtime reachability, and exploit prerequisites so dependency reports describe product impact.
- [Libraries and parsers: bounded fuzzing to a minimal reproducer](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/parser-fuzzing.html) — Build a realistic local harness, instrument the target, bound fuzzing resources, and turn unique faults into defensible library or consumer reports.
- [Object storage, signed URLs and delivery boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/storage-delivery.html) — Follow one private canary through upload, signing, CDN delivery and expiry without enumerating real objects.
- [Container and Kubernetes isolation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/container-kubernetes.html) — Test RBAC, workload identity, admission, networking and host exposure as separate enforcement layers.
- [Infrastructure configuration: from repository default to deployed impact](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/infrastructure-config.html) — Trace IaC, charts, Compose and image packaging into supported deployments, including exposed services and sensitive artifacts.
- [Database, cache, queue and management service boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/network-service-boundaries.html) — Move from a reachable socket to a minimal proof of unintended service authority using synthetic records and paired identities.
- [AI tools: input trust, execution identity and approvals](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/ai-tool-trust.html) — Prove when lower-trust content changes a protected tool action, then locate the missing authorization or consent boundary.
- [RAG isolation: ingestion, retrieval, citations and revocation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/rag-tenant-isolation.html) — Trace document authorization through vector search, generated answers, citation downloads, caches and sharing changes.
- [Contract state: authorization, callbacks and accounting](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/smart-contract-state.html) — Turn protocol promises into explicit invariants and test realistic local operation sequences with independent accounting.
- [Contract signatures and oracles: context, freshness and units](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/contract-signatures-oracles.html) — Test signed-action context and price-consumer assumptions with local keys, mock feeds and explicit negative controls.
- [Firmware update and boot trust: signed bytes, product binding and rollback](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/firmware-update.html) — Separate download trust, update authorization, image verification, rollback policy and boot enforcement using local artifacts.
- [MFA and passkeys: enrollment, proof, replacement, and recovery](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/authenticator-lifecycle.html) — Follow each authenticator from account binding to removal, and validate WebAuthn assertions without mistaking client UI or counter behavior for a security guarantee.
- [OAuth, OIDC, and SAML: transaction binding and token trust](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/federation-token-trust.html) — Separate browser transaction binding, issuer trust, token purpose, and identity linking using controlled federation fixtures.
- [Request values: duplicate parameters, parser conflicts and downstream queries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/request-value-parsing.html) — Trace the value a security layer validates through to the value the application or downstream service actually consumes.
- [Webhooks and integration events: authenticity, tenant binding and replay](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/webhook-event-integrity.html) — Verify the event signature, provider-to-tenant binding and durable worker effect together across retries and out-of-order delivery.
- [GitLab pipelines: contribution, job token and runner boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/gitlab-pipeline-boundaries.html) — Trace GitLab execution context, included configuration, downstream inputs, job-token permissions and runner reuse using private synthetic fixtures.
- [Azure and GCP: identity, delegation and storage access](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/azure-gcp-boundaries.html) — Apply provider-specific controls for Azure management/data permissions and SAS, plus GCP service accounts, federation and object ACLs.
- [Browser extensions: message authority and document lifetime](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/extension-message-boundaries.html) — Trace real page messages into extension capabilities and test sender identity, navigation races, permission changes and worker restarts.
- [AI state: memory, resumed work, retries and private caches](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/ai-state-lifecycle.html) — Test persistent context, task ownership, MCP request-state integrity, duplicate effects and caches across identities and time.
- [Resource budgets and sensitive business flows](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/resource-budget-controls.html) — Trace request fan-out, retries, recipient limits and tenant quotas using tiny local limits, recording stubs and measured downstream effects.

## Vulnerability reference

- [Broken object-level authorization (BOLA / IDOR)](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/bola-controlled-object-access.html)
- [Broken function-level authorization (BFLA)](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/bfla-restricted-function.html)
- [Broken property authorization: private response fields](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/bopla-private-response-property.html)
- [Mass assignment of server-controlled properties](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/mass-assignment-protected-property.html)
- [Authentication or MFA state bypass](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/authentication-incomplete-state-bypass.html)
- [Session fixation across login](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/session-fixation-login-binding.html)
- [Residual access after explicit session revocation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/session-revocation-residual-access.html)
- [Password reset binding or single-use failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/password-reset-account-binding.html)
- [OAuth login or account-linking confusion](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/oauth-login-account-linking-confusion.html)
- [JWT signature, issuer, audience, or token-purpose validation failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/jwt-signature-trust-failure.html)
- [SQL injection](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/sql-query-structure-injection.html)
- [NoSQL operator or query injection](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/nosql-operator-contract-bypass.html)
- [OS command injection](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/os-command-argument-boundary.html)
- [Server-side template injection (SSTI)](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/server-template-expression-injection.html)
- [Reflected or stored cross-site scripting](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/xss-reflected-stored-origin-execution.html)
- [DOM-based cross-site scripting](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/dom-xss-source-sink-flow.html)
- [Cross-site request forgery (CSRF)](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/csrf-browser-forged-state-change.html)
- [CORS private-data exposure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/cors-private-credentialed-read.html)
- [Cross-origin messaging trust failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/postmessage-origin-validation.html)
- [Server-side request forgery (SSRF)](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/ssrf-forbidden-destination.html)
- [Unsafe upload interpretation or placement](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/unsafe-upload-interpretation.html)
- [Path traversal outside an allowed root](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/path-traversal-controlled-canary.html)
- [XML external entity injection (XXE)](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/xxe-external-entity-resolution.html)
- [Archive extraction path escape](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/archive-extraction-path-escape.html)
- [Web cache poisoning](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/web-cache-poisoning-unkeyed-input.html)
- [Web cache deception](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/web-cache-deception-private-response.html)
- [HTTP request smuggling / desynchronization](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/http-request-boundary-desynchronization.html)
- [Race condition in a security-sensitive transition](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/race-condition-duplicate-transition.html)
- [Workflow order or approval bypass](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/workflow-order-validation-bypass.html)
- [Single-use action or idempotency replay failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/single-use-idempotency-replay.html)
- [GraphQL resolver or field authorization failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/graphql-resolver-field-authz.html)
- [WebSocket message or subscription authorization failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/websocket-message-authorization.html)
- [Cross-site WebSocket hijacking](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/cross-site-websocket-hijacking.html)
- [Hard-coded product credentials](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/hardcoded-credentials.html)
- [CI metadata interpreted as executable script](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/ci-script-injection.html)
- [Untrusted contribution executed by privileged CI](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/ci-untrusted-code-execution.html)
- [CI artifact poisoning across a workflow trust boundary](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/ci-artifact-poisoning.html)
- [Dependency confusion and unintended package origin](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/dependency-confusion.html)
- [Unsafe object deserialization](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/unsafe-deserialization.html)
- [JavaScript prototype pollution](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/prototype-pollution.html)
- [Out-of-bounds memory read](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/out-of-bounds-read.html)
- [Out-of-bounds memory write](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/out-of-bounds-write.html)
- [Use after free in a public API or parser lifecycle](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/use-after-free.html)
- [Integer overflow affecting allocation or bounds](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/integer-overflow.html)
- [Parser resource exhaustion and decompression amplification](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/parser-resource-exhaustion.html)
- [Regular-expression denial of service](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/regex-dos.html)
- [Predictable temporary files and unsafe creation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/insecure-temporary-files.html)
- [Untrusted executable, library, or module search path](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/untrusted-search-path.html)
- [Federated cloud role accepts the wrong workload identity](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/cloud-oidc-subject-scope.html)
- [Anonymous access to private object storage](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/cloud-storage-anonymous-read.html)
- [Unauthorized object creation or replacement](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/cloud-storage-unauthorized-write.html)
- [Signed storage capability exceeds its authorized scope](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/cloud-presigned-capability-scope.html)
- [Kubernetes Secret access exceeds tenant permissions](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/kube-secret-rbac-exposure.html)
- [Workload creation grants unintended service-account authority](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/kube-workload-identity-selection.html)
- [Admission policy misses a supported object or update path](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/kube-admission-policy-gap.html)
- [Container exposes unintended host files or privileges](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/container-host-resource-exposure.html)
- [Sensitive values exposed through state or plan artifacts](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/iac-state-secret-exposure.html)
- [Secrets retained in container build artifacts](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/container-build-secret-leak.html)
- [Supported deployment default exposes a protected service](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/iac-insecure-supported-default.html)
- [Redis authentication or key ACL boundary failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/redis-canary-access.html)
- [PostgreSQL trust authentication exceeds the approved network boundary](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/postgres-unintended-trust-auth.html)
- [Message broker permissions cross a virtual-host boundary](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/queue-virtual-host-boundary.html)
- [Container daemon management endpoint lacks required client authentication](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/container-daemon-client-auth.html)
- [TLS peer certificate or hostname verification failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/client-invalid-certificate.html)
- [Updater accepts an artifact outside its publisher trust policy](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/update-untrusted-artifact.html)
- [Indirect prompt injection into protected tool actions](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/indirect-prompt-tool-injection.html)
- [Agent tool accepts unauthorized object or tenant parameters](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/agent-tool-object-authorization.html)
- [Agent approval is not bound to executed arguments](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/agent-approval-argument-drift.html)
- [MCP proxy consent confuses different clients](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/mcp-proxy-confused-deputy.html)
- [MCP accepts a token for another resource](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/mcp-token-audience-confusion.html)
- [RAG retrieval or citation resolver crosses tenant boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/rag-cross-tenant-retrieval.html)
- [RAG cache or fresh retrieval ignores revoked access](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/rag-cache-revocation-leak.html)
- [Contract callback reentrancy violates a state invariant](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/contract-reentrant-state.html)
- [Contract initializer permits unauthorized ownership or configuration](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/contract-unprotected-initializer.html)
- [Contract upgrade authority can be bypassed](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/contract-upgrade-authorization.html)
- [Vault share conversion or rounding breaks entitlement](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/contract-share-accounting.html)
- [Signed contract action can be replayed unexpectedly](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/contract-signature-replay.html)
- [Signed action does not bind its intended context](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/contract-signature-context.html)
- [Oracle freshness or dependency state permits an invalid decision](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/contract-stale-oracle.html)
- [Oracle denomination or decimal conversion is incorrect](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/contract-oracle-unit-confusion.html)
- [Firmware verifier accepts unauthenticated protected bytes](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/firmware-signature-validation.html)
- [Firmware security-version state can be lowered](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/firmware-security-version-rollback.html)
- [Firmware verification fails to enforce required product binding](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/firmware-product-binding.html)
- [Firmware contains a reusable shared authentication credential](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/firmware-shared-credentials.html)
- [Exposed repository or history secret](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/exposed-repository-secret.html)
- [Open redirect across an origin trust boundary](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/open-redirect-trust.html)
- [Clickjacking of a sensitive authenticated action](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/clickjacking-sensitive-action.html)
- [Untrusted Host or forwarding-header origin construction](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/host-header-origin-trust.html)
- [Sensitive data in errors, debug routes, or generated files](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/sensitive-error-disclosure.html)
- [Predictable security token or capability identifier](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/weak-security-token-randomness.html)
- [Password storage without an adequate adaptive hash](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/password-storage-weak-hash.html)
- [Encrypted data accepted without integrity authentication](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/crypto-authentication-missing.html)
- [SAML assertion signature, audience, or response binding failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/saml-assertion-trust.html)
- [Unauthorized authenticator enrollment, replacement, or removal](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/authenticator-management-proof-bypass.html)
- [WebAuthn assertion accepted for an invalid account or ceremony context](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/webauthn-assertion-binding-failure.html)
- [Verification or account merge preserves another actor's access](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/identity-verification-merge-confusion.html)
- [Enforced SSO bypass through an alternate login path](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/enforced-sso-alternate-login-bypass.html)
- [Argument or option injection without shell interpretation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/process-argument-option-injection.html)
- [Parameter or JSON parser disagreement crosses a security check](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/request-parser-value-conflict.html)
- [Server-side parameter pollution in a constructed request](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/downstream-parameter-injection.html)
- [Unverified or tampered webhook causes a protected effect](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/webhook-event-authenticity-failure.html)
- [Authentic integration event applied to the wrong tenant or object](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/webhook-provider-tenant-binding.html)
- [GitLab job token crosses an unintended project boundary](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/gitlab-job-token-boundary.html)
- [Shared CI runner exposes private state across jobs](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/ci-runner-cross-job-state.html)
- [Page message borrows unintended browser-extension authority](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/extension-message-authority.html)
- [Delayed extension result reaches a different document](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/extension-document-reply-confusion.html)
- [Agent conversation, checkpoint or memory crosses ownership boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/ai-persistent-state-ownership.html)
- [MCP resumed state changes authorization or request meaning](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/mcp-resume-state-integrity.html)
- [Private MCP result is reused across authorization contexts](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/mcp-private-cache-context.html)
- [Agent retry commits a protected single-use action twice](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/agent-retry-duplicate-effect.html)
- [Untrusted model artifact reaches executable deserialization or custom code](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/model-artifact-unsafe-loading.html)
- [Unbounded resource allocation or request amplification](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/resource-allocation-limit-failure.html)
- [Sensitive business flow exceeds its permitted frequency or allocation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/sensitive-flow-frequency-limit.html)