# Sources and research notes

Primary documentation, program policies, maintainers’ publications and official tool references underpin this manual. Sources were accessed on **11 September 2026**. The working frameworks, milestones, priorities and test designs are analytical recommendations unless explicitly attributed to a program requirement.

## How to read the evidence

Program policy is time-sensitive. Check the exact asset, current intake, supported release, testing method, researcher eligibility and reward conditions before starting a new hunt. Undated documentation is a living reference, not a guarantee that an older deployment implements the same behavior. Archived Apple material is identified as historical; current MCP guidance is explicitly versioned.

Some Google OSS policy content was not fully extractable. The platform chapter marks this limitation and does not reconstruct missing reward tiers. Some OWASP pages failed to render; where available, citations use their official source repositories. No live targets were tested. Tool examples are documentation-reviewed recipes, not execution results. The uploaded all.txt supports only the local inventory counts stated in the scope chapter.

## Reference inventory

The sections below retain publishers, exact links, dates or versions, and claim context from the individual chapters. Some sources occur in more than one branch because they support different decisions.

## Roadmap

[Read the associated chapter](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/roadmap.html).

- PortSwigger. [Web Security Academy](https://portswigger.net/web-security). Live training catalog; undated; accessed 11 September 2026. Used for the lab resource recommendation.
- OWASP Foundation. [Juice Shop](https://owasp.org/www-project-juice-shop/). Live project documentation; accessed 11 September 2026. Used for intentionally vulnerable application practice.
- OWASP Foundation. [crAPI](https://owasp.org/www-project-crapi/). Undated project documentation; accessed 11 September 2026. Used for API-specific practice.


## Platforms & participation

[Read the associated chapter](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/platforms.html).

Original registry accessed **2026-09-11**. A selective follow-up review on **2026-09-14** rechecked the participation mechanics and policy-sensitive claims described above. “Undated/current” records the original retrieval context; it does not certify every program’s present intake. Google’s dynamic policy bodies and the direct IBB policy body could not be reverified. Search-index information is labeled where used, and no inaccessible page is treated as proof that a program closed or reopened.

| Source title | Publisher | Publication/update date | Exact URL | Claim used |
|---|---|---|---|---|
| Bug Bounty Programs | HackerOne | Undated/current | https://www.hackerone.com/bug-bounty-programs | Program discovery route |
| Invitations | HackerOne | 2025-10-15 | https://docs.hackerone.com/en/articles/8470802-invitations | Reputation, signal, conduct, solicitation prohibition |
| Private Opportunities | HackerOne | 2025-01-29 | https://docs.hackerone.com/en/articles/10485859-private-opportunities | Eligible researchers can claim listed opportunities; limited availability |
| Finding a Program | Bugcrowd | Current documentation | https://docs.bugcrowd.com/researchers/participating-in-program/finding-program/ | Public/private access, brief and special requirements |
| Viewing and Accepting Invitations | Bugcrowd | Current documentation | https://docs.bugcrowd.com/researchers/invites/viewing-and-accepting-engagement-invitations/ | Newer engagement matching criteria |
| Viewing and Accepting Program Invitations | Bugcrowd | Current documentation | https://docs.bugcrowd.com/researchers/participating-in-program/viewing-invitations/ | Older numerical criteria differ from newer engagement language |
| Program confidentiality levels | Intigriti | 2025-12-18 | https://kb.intigriti.com/en/articles/13175939-program-confidentiality-levels | Four participation modes |
| Program settings | Intigriti | 2025-12-18 | https://kb.intigriti.com/en/articles/5928505-program-settings | Identity, geography, 2FA and payout restrictions |
| Programs | YesWeHack | Undated/current | https://helpcenter.yeswehack.io/en/collections/875314-programs | Scope grids, grey-box credentials, VPN |
| Invite new hunters on a program | YesWeHack | Relative update label only on 2026-09-14; exact date unverified | https://helpcenter.yeswehack.io/en/articles/376664-invite-new-hunters-on-a-program | Curated invitation criteria |
| Huntr 2.0 FAQ | Huntr / Palo Alto Networks | 2026; retrieved page had no exact date | https://blog.huntr.com/huntr-2-0-faq | OSS intake closure/freeze; challenge pivot; provisional model-format route |
| Google OSS VRP Rules | Google | Undated/current | https://bughunters.google.com/about/rules/open-source/google-open-source-software-vulnerability-reward-program-rules | Current OSS policy route; dynamic body incomplete |
| Streamlining Google's OSS VRP: Key Rule Updates | Google | 2026 title; exact update date not reverified 2026-09-14 | https://bughunters.google.com/blog/ossvrp-rule-updates-2026 | 2026 rule update exists; do not reuse launch-era rules |
| Patch Rewards Program Rules | Google | Undated/current | https://bughunters.google.com/about/rules/open-source/patch-rewards-program-rules | Separate patch incentive |
| Internet Bug Bounty policy | HackerOne / IBB | Direct policy body unavailable 2026-09-14 | https://hackerone.com/ibb | Previous policy reference; current intake controls and exact pause date not reverified |
| Security Bug Bounty Program Paused Due to Loss of Funding | Node.js | Updated 2026-04-02 | https://nodejs.org/en/blog/announcements/discontinuing-security-bug-bounties | IBB loss pauses Node.js payments while intake continues |
| Privately reporting a security vulnerability | GitHub | Undated/current | https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/report-privately | Repository private reporting and private forks |
| Next chapter: Restructuring GitHub's bug bounty program | GitHub | 2026-07-22; effective 2026-07-27 | https://github.blog/security/next-chapter-restructuring-githubs-bug-bounty-program/ | Public/VIP restructuring and signal gate |
| GitHub Security | GitHub | Undated/current | https://bounty.github.com/ | Product program entry point |
| GitLab Bug Bounty Program policy updates | GitLab | 2026-01-20 | https://about.gitlab.com/blog/gitlab-bug-bounty-program-policy-updates/ | Self-managed versus hosted testing and scope |
| Bug Bounty Program | Wordfence | Undated/current | https://www.wordfence.com/threat-intel/bug-bounty-program | Tiers and eligibility conditions |
| Bug Bounty Guidelines & Rules (2026 edition) | Patchstack | Published 2022-07-10; update effective 2026-09-01 | https://patchstack.com/articles/bug-bounty-guidelines-rules/ | Pool/individual reward distinction and recent conditions |
| Microsoft Bounty Programs | Microsoft | Undated/current | https://www.microsoft.com/en-us/msrc/bounty | Program families |
| In scope by default | Microsoft MSRC | 2025-12-11 | https://www.microsoft.com/en-us/msrc/blog/2025/12/in-scope-by-default | Critical online-service impact expansion |
| Guidelines | Apple Security Research | Undated/current | https://security.apple.com/bounty/guidelines/ | Actionable evidence and reward eligibility |
| Security Research Device Program | Apple | Undated/current | https://security.apple.com/research-device/ | Separate research-device program |
| Security Bug Bounty Program | Mozilla | Undated/current | https://www.mozilla.org/en-US/security/bug-bounty/ | Mozilla program entry |
| Client Bug Bounty Program | Mozilla | Undated/current | https://www.mozilla.org/en-US/security/client-bug-bounty/ | Supported client configurations, proof requirements, mitigation scope |
| Bug Bounty Programs | Immunefi | Current directory | https://immunefi.com/bug-bounty/ | Web3 bounty directory |
| Bug bounty and crowdsourced audit platform | HackenProof | Current homepage | https://hackenproof.com/ | Live platform/route types |
| Opportunities | Cantina | Current directory | https://cantina.xyz/opportunities | Bounties, competitions and deposit indicators |
| Welcome to Cantina | Cantina | Current documentation | https://docs.cantina.security/introduction | Current documentation/domain |
| Competitions | Code4rena | Current documentation | https://docs.code4rena.com/ | Competitive audit route |
| Bounties | Code4rena | Current documentation; indexed 2026-03-25 | https://docs.code4rena.com/bounties | Runnable proof, severity and 25 USDC deposit |
| Audits | Sherlock | Current documentation | https://docs.sherlock.xyz/audits | Contest process and judging/payout documentation |
| About Us | TrendAI Zero Day Initiative | Undated/current | https://www.zerodayinitiative.com/about/ | Vendor-agnostic acquisition and coordination |
| Pwn2Own Berlin 2026 Rules | ZDI | 2026 event rules | https://www.zerodayinitiative.com/Pwn2OwnBerlin2026Rules.html | Fixed event, registration and technical target conditions |
| RFC 9116 | IETF / RFC Editor | 2022-04 | https://www.rfc-editor.org/rfc/rfc9116.html | Contact/policy discovery; no implied test authorization |
| Vulnerability Disclosure Policy | US Consumer Product Safety Commission | Undated/current | https://www.cpsc.gov/vulnerability-disclosure-policy | Institutional VDP and stopping conditions |
| BUG-BOUNTY.md | curl project | Current repository policy | https://github.com/curl/curl/blob/master/docs/BUG-BOUNTY.md | End of curl bounty in January 2026 |
| The end of the curl bug-bounty | Daniel Stenberg, curl maintainer | 2026-01-26 | https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-bug-bounty/ | Closure effective 2026-01-31 |
| Google-owned product vulnerability intake | Google | Undated; official index checked 2026-09-14 | https://bughunters.google.com/report/vrp | Broader Google product/service reporting route; dynamic body unavailable |


## Scope model

[Read the associated chapter](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/scope.html).

- Foudil, E., and Y. Shafranovich / IETF. [RFC 9116: A File Format to Aid in Security Vulnerability Disclosure](https://www.rfc-editor.org/rfc/rfc9116.html). April 2022; accessed 11 September 2026. Used for security.txt location, scope and lack of implied testing permission.
- HackerOne. [Gold Standard Safe Harbor Statement](https://docs.hackerone.com/en/articles/8494525-gold-standard-safe-harbor-statement). 11 August 2025; accessed 11 September 2026. Used for third-party and policy-compliance limits.
- Uploaded all.txt. Local supplied copy; accessed 11 September 2026. Used only for line-level inventory analysis; no public URL or authorization evidence.


## Operating playbook

[Read the associated chapter](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/operations.html).

- FIRST. [CVSS v4.0 Specification Document](https://www.first.org/cvss/v4.0/specification-document), document version 1.2; accessed 11 September 2026. Used for severity characteristics and metric groups.
- FIRST. [CVSS v4.0 User Guide](https://www.first.org/cvss/v4.0/user-guide), version 1.2, 14 November 2025; accessed 11 September 2026. Used for Base severity versus risk and score/vector presentation.
- CVE Program. [CNA Operational Rules](https://www.cve.org/ResourcesSupport/AllResources/CNARules), version 4.1.0, effective 14 May 2025; accessed 11 September 2026. Used for CVE/CNA coordination context.


## OSS & self-hosted

[Read the associated chapter](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/oss.html).

All sources were accessed on **2026-09-11**. Unless a date is listed, the cited documentation is undated/living documentation; tool and service behavior must be checked again when used.

| Publisher | Source | Publication/update date | Supports |
|---|---|---|---|
| OWASP | [Secure Code Review](https://cheatsheetseries.owasp.org/cheatsheets/Secure_Code_Review_Cheat_Sheet.html) | Undated | Manual review, logic/data-flow emphasis |
| GitHub | [Privately reporting a vulnerability](https://docs.github.com/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability) | Undated | Private reporting availability |
| GitHub | [Repository security advisories](https://docs.github.com/code-security/security-advisories/repository-security-advisories/about-repository-security-advisories) | Undated | Private collaboration/disclosure |
| GitHub | [Publishing an advisory](https://docs.github.com/code-security/security-advisories/working-with-repository-security-advisories/publishing-a-repository-security-advisory) | Undated | CVE request workflow |
| Semgrep | [Taint analysis](https://docs.semgrep.dev/writing-rules/data-flow/taint-mode/overview) | Undated | Sources, sinks, propagators, sanitizers |
| Semgrep | [CLI reference](https://docs.semgrep.dev/cli-reference) | Undated | Local rules, flags, engine capabilities |
| Semgrep | [Licensing](https://docs.semgrep.dev/licensing) and [Rules License](https://semgrep.dev/legal/rules-license/) | Undated | CE and rule licensing distinctions |
| Gitleaks maintainers | [Official repository documentation](https://github.com/gitleaks/gitleaks) | Undated | Current commands, history, redaction |
| Anchore | [Syft](https://github.com/anchore/syft) and [output formats](https://oss.anchore.com/docs/guides/sbom/formats/) | Undated | SBOM inventory and output syntax |
| Google | [OSV usage](https://google.github.io/osv-scanner/usage/), [source scanning](https://google.github.io/osv-scanner/usage/scan-source), [offline mode](https://google.github.io/osv-scanner/usage/offline-mode/) | Undated | Version matching, recursion, offline limits |
| Aqua Security | [Trivy filesystem reference](https://trivy.dev/docs/latest/references/configuration/cli/trivy_filesystem/) | Undated | Scanners and individual offline/update flags |
| GitHub | [Secure use reference](https://docs.github.com/en/actions/reference/security/secure-use) | Undated | Least privilege, immutable action references |
| GitHub | [Workflow events](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows) and [pull_request_target guidance](https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target) | Undated | Event trust boundaries and current protections |
| GitHub | [OIDC in AWS](https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-aws) | Undated | Subject/identity restrictions |
| npm | [Trusted publishing](https://docs.npmjs.com/trusted-publishers/) | Updated 2026-09-03 | Publisher identity and authentication |
| Python Package Index | [Trusted publisher security model](https://docs.pypi.org/trusted-publishers/security-model/) | Undated | Workflow compromise and publishing trust |
| LLVM Project | [libFuzzer](https://llvm.org/docs/LibFuzzer.html) | Undated | Harness, corpus, bounds, minimization |
| GitHub | [CodeQL CLI](https://docs.github.com/en/code-security/concepts/code-scanning/codeql/codeql-cli), [database preparation](https://docs.github.com/en/code-security/tutorials/customize-code-scanning/prepare-code-for-analysis), [analysis](https://docs.github.com/en/code-security/tutorials/customize-code-scanning/analyze-code) | Undated | Eligibility and local CLI workflow |
| Git Project | [git-rev-parse](https://git-scm.com/docs/git-rev-parse) | Undated | Commit identity command |
| Andrew Gallant/ripgrep contributors | [ripgrep guide](https://github.com/BurntSushi/ripgrep/blob/master/GUIDE.md) | Undated | Local file inventory flags |


## Web & API

[Read the associated chapter](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/web-api.html).

All sources accessed 2026-09-11. “Undated” means no reliable publication date was established; it does not imply old content. Sources were read directly. This chapter's test budgets, matrices, ordering and stopping rules are synthesis, not quotations from those sources.

| Source | Date/version | URL |
|---|---|---|
| OWASP WSTG project | v4.2 released 2020-12-03; v5 development | https://owasp.org/www-project-web-security-testing-guide/ |
| OWASP ASVS | v5.0.0 released 2025-05-30 | https://owasp.org/www-project-application-security-verification-standard/ |
| ProjectDiscovery Subfinder usage | Undated | https://docs.projectdiscovery.io/opensource/subfinder/usage |
| ProjectDiscovery httpx usage | Undated | https://docs.projectdiscovery.io/opensource/httpx/usage |
| curl manual | Undated rolling manual | https://curl.se/docs/manpage.html |
| PortSwigger access control | Undated | https://portswigger.net/web-security/access-control |
| PortSwigger GraphQL | Undated | https://portswigger.net/web-security/graphql |
| gRPC authentication | Last modified 2024-01-12 | https://grpc.io/docs/guides/auth/ |
| gRPC reflection | Undated | https://grpc.io/docs/guides/reflection/ |
| PortSwigger WebSockets | Undated | https://portswigger.net/web-security/websockets |
| OWASP Session Management | Undated | https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html |
| RFC 9700 OAuth Security BCP | January 2025 | https://www.rfc-editor.org/rfc/rfc9700.html |
| PortSwigger OAuth | Undated | https://portswigger.net/web-security/oauth |
| OpenID Connect Core | 1.0 incorporating errata set 2 | https://openid.net/specs/openid-connect-core-1_0.html |
| OWASP SAML Security | Undated | https://cheatsheetseries.owasp.org/cheatsheets/SAML_Security_Cheat_Sheet.html |
| PortSwigger business logic | Undated | https://portswigger.net/web-security/logic-flaws |
| PortSwigger race conditions | Undated | https://portswigger.net/web-security/race-conditions |
| PortSwigger SQL injection | Undated | https://portswigger.net/web-security/sql-injection |
| PortSwigger NoSQL injection | Undated | https://portswigger.net/web-security/nosql-injection |
| PortSwigger template injection | Undated | https://portswigger.net/web-security/server-side-template-injection |
| PortSwigger XSS | Undated | https://portswigger.net/web-security/cross-site-scripting |
| PortSwigger file uploads | Undated | https://portswigger.net/web-security/file-upload |
| PortSwigger path traversal | Undated | https://portswigger.net/web-security/file-path-traversal |
| PortSwigger SSRF | Undated | https://portswigger.net/web-security/ssrf |
| PortSwigger CSRF | Undated | https://portswigger.net/web-security/csrf |
| PortSwigger CORS | Undated | https://portswigger.net/web-security/cors |
| PortSwigger cache poisoning | Undated | https://portswigger.net/web-security/web-cache-poisoning |
| PortSwigger request smuggling | Undated | https://portswigger.net/web-security/request-smuggling |
| Nmap port states | Undated | https://nmap.org/book/man-port-scanning-basics.html |
| Nmap version detection | Undated | https://nmap.org/book/man-version-detection.html |
| OWASP TLS | Undated | https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html |
| BIND manual | Rolling development manual, undated | https://bind9.readthedocs.io/en/latest/manpages.html |
| OpenSSL s_client | Version 3.5 manual, undated | https://docs.openssl.org/3.5/man1/openssl-s_client/ |

Review update, 14 September 2026: the official [OWASP API Security Top 10 2023 overview](https://api-security.owasp.org/editions/2023/en/0x11-t10/), BOLA and object-property authorization pages were successfully retrieved. Original source-registry access dates remain historical.


## Network services

[Read the associated chapter](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/network.html).

All accessed 2026-09-11. Undated means a reliable publication date was not established. RFCs below substantiate protocol mechanics, not a claim that no later updating RFC exists.

| Source | Date/version | URL |
|---|---|---|
| Nmap port states | Undated | https://nmap.org/book/man-port-scanning-basics.html |
| Nmap port selection | Undated | https://nmap.org/book/man-port-specification.html |
| Nmap discovery | Undated | https://nmap.org/book/man-host-discovery.html |
| Nmap timing | Undated | https://nmap.org/book/man-performance.html |
| Nmap IPv6/miscellaneous | Undated | https://nmap.org/book/man-misc-options.html |
| Nmap version detection | Undated | https://nmap.org/book/man-version-detection.html |
| BIND dig | Version 9.20.13 manual | https://bind9.readthedocs.io/en/v9.20.13/manpages.html#dig-dns-lookup-utility |
| OpenSSL s_client | Version 3.5 manual | https://docs.openssl.org/3.5/man1/openssl-s_client/ |
| Red Hat backporting | Undated | https://access.redhat.com/security/updates/backporting |
| Redis security | Undated rolling docs | https://redis.io/docs/latest/operate/oss_and_stack/management/security/ |
| PostgreSQL authentication | Version 18 rolling docs | https://www.postgresql.org/docs/current/auth-pg-hba-conf.html |
| DNSSEC RFC 4033 | March 2005 | https://www.rfc-editor.org/rfc/rfc4033.html |
| SPF RFC 7208 | April 2014 | https://www.rfc-editor.org/rfc/rfc7208.html |
| DKIM RFC 6376 | September 2011 | https://www.rfc-editor.org/rfc/rfc6376.html |
| DMARC RFC 7489 | March 2015 | https://www.rfc-editor.org/rfc/rfc7489.html |
| SMTP RFC 5321 | October 2008 | https://www.rfc-editor.org/rfc/rfc5321.html |


## Mobile

[Read the associated chapter](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/mobile.html).

All sources accessed **2026-09-11**. “Undated” means no reliable publication/update date was established from the retrieved page. Dates are page metadata, not a guarantee of completeness for every current OS version. Archived Apple sources are used for established mechanisms and command syntax, not blanket claims about current platform enforcement.

| ID | Publisher / exact source | Date | Use |
|---|---|---|---|
| MD01 | OWASP, [OWASP MASVS](https://mas.owasp.org/MASVS/) | Undated; living standard | Mobile control organization |
| MD02 | OWASP, [OWASP MASTG](https://mas.owasp.org/MASTG/) | Undated; living guide | Testing methodology and technique catalog |
| MD03 | OWASP, [Mobile Application Security Weakness Enumeration](https://mas.owasp.org/MASWE/) | Undated; living catalog | Weakness taxonomy and version caution |
| MD04 | Google, [Android Debug Bridge](https://developer.android.com/tools/adb) | Updated 2026-09-02 | Device/package inspection commands |
| MD05 | Google, [apkanalyzer](https://developer.android.com/tools/apkanalyzer) | Updated 2026-03-05 | APK metadata and manifest CLI |
| MD06 | Google, [apksigner](https://developer.android.com/tools/apksigner) | Updated 2026-03-05 | APK certificate/signature inspection |
| MD07 | Google, [android:exported](https://developer.android.com/privacy-and-security/risks/android-exported) | 2024-09-24, indexed page date | Component exposure and version dependence |
| MD08 | Google, [Unsafe use of deep links](https://developer.android.com/privacy-and-security/risks/unsafe-use-of-deeplinks) | 2024-10-24, indexed page date | Deep-link validation |
| MD09 | Google, [WebView – Native bridges](https://developer.android.com/privacy-and-security/risks/insecure-webview-native-bridges) | Updated 2024-10-15 | Frames, native bridges, origin boundaries |
| MD10 | Google, [Network security configuration](https://developer.android.com/privacy-and-security/security-config) | Updated 2026-08-28 | Trust anchors and debug overrides |
| MD11 | Google, [Content provider basics](https://developer.android.com/guide/topics/providers/content-provider-basics) | Undated in this registry | Provider access model |
| MD12 | skylot/JADX maintainers, [JADX repository and CLI](https://github.com/skylot/jadx) | Undated; living README | Decompiler usage and limitations |
| MD13 | Apktool maintainers, [CLI Parameters](https://apktool.org/docs/cli-parameters/) | Undated | Local package decoding |
| MD14 | OWASP, [iOS Security Testing](https://mas.owasp.org/MASTG/0x06b-iOS-Security-Testing/) | Undated | iOS lab/platform distinctions |
| MD15 | Apple, [Keychain data protection](https://support.apple.com/guide/security/keychain-data-protection-secb0694df1a/web) | Published 2024-12-19 | Access groups, classes, authentication constraints |
| MD16 | Apple, [Support Universal Links](https://developer.apple.com/library/archive/documentation/General/Conceptual/AppSearch/UniversalLinks.html) | Updated 2016-12-15; archived | App/website association model |
| MD17 | OWASP, [MASTG-TOOL-0062: Plutil](https://mas.owasp.org/MASTG/tools/ios/MASTG-TOOL-0062/) | Undated | Property-list inspection tooling |
| MD18 | OWASP, [MASTG-TECH-0111: Extracting Entitlements from MachO Binaries](https://mas.owasp.org/MASTG/techniques/ios/MASTG-TECH-0111/) | Undated | Signing/entitlement inspection |
| MD19 | Apple, [TN2206: macOS Code Signing In Depth](https://developer.apple.com/library/archive/technotes/tn2206/_index.html) | Page updated 2016-09-13; archived | Signature verification command and boundaries |
| MD20 | Microsoft / Mark Russinovich, [Process Monitor](https://learn.microsoft.com/en-us/sysinternals/downloads/procmon) | Published 2026-09-10 | Local process, registry, filesystem observation |
| MD21 | Microsoft, [Get-AuthenticodeSignature](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-authenticodesignature?view=powershell-7.5) | Undated; PowerShell 7.5 documentation | Windows signature inspection |
| MD22 | Microsoft, [icacls](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/icacls) | Updated 2025-06-09 | Windows ACL inspection |
| MD23 | OpenJS Foundation / Electron contributors, [Security](https://www.electronjs.org/docs/latest/tutorial/security) | Undated; living documentation | Renderer, navigation, IPC boundaries |
| MD24 | Electron contributors, [Context Isolation](https://www.electronjs.org/docs/latest/tutorial/context-isolation) | Undated | Bridge limitations and API exposure |
| MD25 | Google, [Stay secure](https://developer.chrome.com/docs/extensions/develop/security-privacy/stay-secure) | Page states updated 2018-03-06 | Extension permissions and untrusted messages |
| MD26 | Google, [Message passing](https://developer.chrome.com/docs/extensions/develop/concepts/messaging) | Page states updated 2025-12-03 | Extension messaging contexts |
| MD27 | Google, [Native messaging](https://developer.chrome.com/docs/extensions/develop/concepts/native-messaging) | Page states updated 2023-02-27 | Native host manifest and execution boundary |
| MD28 | AFL++ maintainers, [Fuzzing in Depth](https://aflplus.plus/docs/fuzzing_in_depth/) | Undated; living guide | Harness, corpus, execution, resource limits |
| MD29 | GNU Binutils / Sourceware, [readelf](https://sourceware.org/binutils/docs/binutils/readelf.html) | Undated | Non-executing ELF metadata inspection |


## Desktop & extensions

[Read the associated chapter](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/desktop.html).

All sources accessed **2026-09-11**. “Undated” means no reliable publication/update date was established from the retrieved page. Dates are page metadata, not a guarantee of completeness for every current OS version. Archived Apple sources are used for established mechanisms and command syntax, not blanket claims about current platform enforcement.

| ID | Publisher / exact source | Date | Use |
|---|---|---|---|
| MD01 | OWASP, [OWASP MASVS](https://mas.owasp.org/MASVS/) | Undated; living standard | Mobile control organization |
| MD02 | OWASP, [OWASP MASTG](https://mas.owasp.org/MASTG/) | Undated; living guide | Testing methodology and technique catalog |
| MD03 | OWASP, [Mobile Application Security Weakness Enumeration](https://mas.owasp.org/MASWE/) | Undated; living catalog | Weakness taxonomy and version caution |
| MD04 | Google, [Android Debug Bridge](https://developer.android.com/tools/adb) | Updated 2026-09-02 | Device/package inspection commands |
| MD05 | Google, [apkanalyzer](https://developer.android.com/tools/apkanalyzer) | Updated 2026-03-05 | APK metadata and manifest CLI |
| MD06 | Google, [apksigner](https://developer.android.com/tools/apksigner) | Updated 2026-03-05 | APK certificate/signature inspection |
| MD07 | Google, [android:exported](https://developer.android.com/privacy-and-security/risks/android-exported) | 2024-09-24, indexed page date | Component exposure and version dependence |
| MD08 | Google, [Unsafe use of deep links](https://developer.android.com/privacy-and-security/risks/unsafe-use-of-deeplinks) | 2024-10-24, indexed page date | Deep-link validation |
| MD09 | Google, [WebView – Native bridges](https://developer.android.com/privacy-and-security/risks/insecure-webview-native-bridges) | Updated 2024-10-15 | Frames, native bridges, origin boundaries |
| MD10 | Google, [Network security configuration](https://developer.android.com/privacy-and-security/security-config) | Updated 2026-08-28 | Trust anchors and debug overrides |
| MD11 | Google, [Content provider basics](https://developer.android.com/guide/topics/providers/content-provider-basics) | Undated in this registry | Provider access model |
| MD12 | skylot/JADX maintainers, [JADX repository and CLI](https://github.com/skylot/jadx) | Undated; living README | Decompiler usage and limitations |
| MD13 | Apktool maintainers, [CLI Parameters](https://apktool.org/docs/cli-parameters/) | Undated | Local package decoding |
| MD14 | OWASP, [iOS Security Testing](https://mas.owasp.org/MASTG/0x06b-iOS-Security-Testing/) | Undated | iOS lab/platform distinctions |
| MD15 | Apple, [Keychain data protection](https://support.apple.com/guide/security/keychain-data-protection-secb0694df1a/web) | Published 2024-12-19 | Access groups, classes, authentication constraints |
| MD16 | Apple, [Support Universal Links](https://developer.apple.com/library/archive/documentation/General/Conceptual/AppSearch/UniversalLinks.html) | Updated 2016-12-15; archived | App/website association model |
| MD17 | OWASP, [MASTG-TOOL-0062: Plutil](https://mas.owasp.org/MASTG/tools/ios/MASTG-TOOL-0062/) | Undated | Property-list inspection tooling |
| MD18 | OWASP, [MASTG-TECH-0111: Extracting Entitlements from MachO Binaries](https://mas.owasp.org/MASTG/techniques/ios/MASTG-TECH-0111/) | Undated | Signing/entitlement inspection |
| MD19 | Apple, [TN2206: macOS Code Signing In Depth](https://developer.apple.com/library/archive/technotes/tn2206/_index.html) | Page updated 2016-09-13; archived | Signature verification command and boundaries |
| MD20 | Microsoft / Mark Russinovich, [Process Monitor](https://learn.microsoft.com/en-us/sysinternals/downloads/procmon) | Published 2026-09-10 | Local process, registry, filesystem observation |
| MD21 | Microsoft, [Get-AuthenticodeSignature](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-authenticodesignature?view=powershell-7.5) | Undated; PowerShell 7.5 documentation | Windows signature inspection |
| MD22 | Microsoft, [icacls](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/icacls) | Updated 2025-06-09 | Windows ACL inspection |
| MD23 | OpenJS Foundation / Electron contributors, [Security](https://www.electronjs.org/docs/latest/tutorial/security) | Undated; living documentation | Renderer, navigation, IPC boundaries |
| MD24 | Electron contributors, [Context Isolation](https://www.electronjs.org/docs/latest/tutorial/context-isolation) | Undated | Bridge limitations and API exposure |
| MD25 | Google, [Stay secure](https://developer.chrome.com/docs/extensions/develop/security-privacy/stay-secure) | Page states updated 2018-03-06 | Extension permissions and untrusted messages |
| MD26 | Google, [Message passing](https://developer.chrome.com/docs/extensions/develop/concepts/messaging) | Page states updated 2025-12-03 | Extension messaging contexts |
| MD27 | Google, [Native messaging](https://developer.chrome.com/docs/extensions/develop/concepts/native-messaging) | Page states updated 2023-02-27 | Native host manifest and execution boundary |
| MD28 | AFL++ maintainers, [Fuzzing in Depth](https://aflplus.plus/docs/fuzzing_in_depth/) | Undated; living guide | Harness, corpus, execution, resource limits |
| MD29 | GNU Binutils / Sourceware, [readelf](https://sourceware.org/binutils/docs/binutils/readelf.html) | Undated | Non-executing ELF metadata inspection |


## Cloud & containers

[Read the associated chapter](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/cloud.html).

All accessed 11 September 2026. Match living documentation to the target version.

| Publisher | Source | Publication or version |
|---|---|---|
| Amazon Web Services | [Penetration Testing](https://aws.amazon.com/security/penetration-testing/) | Undated |
| Microsoft Security Response Center | [Microsoft Security Testing Rules of Engagement](https://www.microsoft.com/en-us/msrc/pentest-rules-of-engagement) | Undated |
| Google | [Cloud Security FAQ](https://support.google.com/cloud/answer/6262505?hl=en) | Undated |
| Amazon Web Services | [Policy evaluation logic](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html) | Undated |
| Amazon Web Services | [Download and upload objects with presigned URLs](https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html) | Undated |
| Kubernetes | [Multi-tenancy](https://kubernetes.io/docs/concepts/security/multi-tenancy/) | Undated living documentation |
| Kubernetes | [Role Based Access Control Good Practices](https://kubernetes.io/docs/concepts/security/rbac-good-practices/) | Undated living documentation |
| Kubernetes | [Admission Webhook Good Practices](https://kubernetes.io/docs/concepts/cluster-administration/admission-webhooks-good-practices/) | Undated living documentation |
| Kubernetes | [Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/) | Undated living documentation |
| Kubernetes | [Using RBAC Authorization](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) | Undated living documentation |
| HashiCorp | [Manage sensitive data in your configuration](https://developer.hashicorp.com/terraform/language/manage-sensitive-data) | Undated |
| Amazon Web Services | [get-caller-identity — AWS CLI v2 Command Reference](https://docs.aws.amazon.com/cli/latest/reference/sts/get-caller-identity.html) | Undated living documentation |
| Amazon Web Services | [get-bucket-policy-status — AWS CLI v2 Command Reference](https://docs.aws.amazon.com/cli/latest/reference/s3api/get-bucket-policy-status.html) | Undated living documentation |
| Microsoft Learn | [az account](https://learn.microsoft.com/en-us/cli/azure/account?view=azure-cli-latest) | Undated living documentation |
| Google Cloud | [gcloud projects get-iam-policy](https://docs.cloud.google.com/sdk/gcloud/reference/projects/get-iam-policy) | Undated living documentation |
| Kubernetes | [kubectl auth can-i](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_auth/kubectl_auth_can-i/) | Undated living documentation |
| Docker | [docker image inspect](https://docs.docker.com/reference/cli/docker/image/inspect/) | Undated |
| HashiCorp | [terraform validate command reference](https://developer.hashicorp.com/terraform/cli/commands/validate) | Undated |


## AI, agents & MCP

[Read the associated chapter](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/ai.html).

All accessed 11 September 2026. Match living documentation to the target version.

| Publisher | Source | Publication or version |
|---|---|---|
| OWASP Foundation | [OWASP AI Testing Guide](https://owasp.org/www-project-ai-testing-guide/) | 2025-11-26 (v1 announcement) |
| OWASP GenAI Security Project | [LLM Top 10](https://genai.owasp.org/llm-top-10/) | 2025 edition |
| OWASP GenAI Security Project | [LLM06:2025 Excessive Agency](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/) | 2025 edition |
| OWASP GenAI Security Project | [LLM08:2025 Vector and Embedding Weaknesses](https://genai.owasp.org/llmrisk/llm082025-vector-and-embedding-weaknesses/) | 2025 edition |
| OWASP GenAI Security Project | [LLM07:2025 System Prompt Leakage](https://genai.owasp.org/llmrisk/llm072025-system-prompt-leakage/) | 2025 edition |
| Model Context Protocol | [Tools](https://modelcontextprotocol.io/specification/2026-07-28/server/tools) | 2026-07-28 |
| Model Context Protocol | [Key Changes](https://modelcontextprotocol.io/specification/2026-07-28/changelog) | 2026-07-28 |
| Model Context Protocol | [Authorization](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization) | 2026-07-28 |
| Model Context Protocol | [Security Best Practices](https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/security_best_practices) | 2026-07-28 revision |
| Model Context Protocol | [Streamable HTTP](https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http) | 2026-07-28 |
| Hugging Face | [Customizing models — Transformers](https://huggingface.co/docs/transformers/custom_models) | Undated |
| PyTorch | [Serialization semantics](https://docs.pytorch.org/docs/stable/notes/serialization.html) | Undated living documentation |
| Andrew Gallant / ripgrep contributors | [ripgrep User Guide](https://github.com/BurntSushi/ripgrep/blob/master/GUIDE.md) | Undated living repository |
| Python Software Foundation | [hashlib — Secure hashes and message digests](https://docs.python.org/3/library/hashlib.html) | Undated living documentation |
| Python Software Foundation | [json — JSON encoder and decoder](https://docs.python.org/3/library/json.html) | Undated living documentation |
| Python Software Foundation | [secrets — Generate secure random numbers for managing secrets](https://docs.python.org/3/library/secrets.html) | Undated living documentation |
| Python Software Foundation | [Command-line options](https://docs.python.org/3/using/cmdline.html) | Living documentation |


## Web3 & protocols

[Read the associated chapter](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/web3.html).

All sources accessed 2026-09-11. Documentation pages are undated unless noted; versioned documentation must be matched to the target’s actual dependency version.

1. Immunefi. [Rules](https://immunefi.com/rules/). Undated, current rules.
2. Immunefi. [Immunefi Bug Bounty: Information](https://immunefi.com/bug-bounty/immunefi/information/). Undated, current program example.
3. Foundry. [Fork Testing](https://www.getfoundry.sh/guides/fork-testing). Undated; search index displays 2026-08-28.
4. Foundry. [Testing](https://www.getfoundry.sh/forge/testing). Undated; search index displays 2026-07-09.
5. Foundry. [forge test](https://www.getfoundry.sh/reference/forge/test). Undated CLI reference.
6. Foundry. [Invariant Testing](https://getfoundry.sh/forge/invariant-testing?highlight=invariant). Undated.
7. Trail of Bits / Crytic. [Slither Usage](https://github.com/crytic/slither/wiki/Usage). Edited 2024-07-23.
8. OpenZeppelin. [Proxy](https://docs.openzeppelin.com/contracts/5.x/api/proxy). Contracts 5.x; undated.
9. Solidity. [Security Considerations](https://docs.soliditylang.org/en/latest/security-considerations.html). Rolling development documentation; undated.
10. Chainlink. [Data Feeds API Reference](https://docs.chain.link/data-feeds/api-reference). Undated.
11. Chainlink. [L2 Sequencer Uptime Feeds](https://docs.chain.link/data-feeds/l2-sequencer-feeds). Undated.
12. OpenZeppelin. [ERC-4626](https://docs.openzeppelin.com/contracts/5.x/erc4626). Contracts 5.x; undated.
13. Ethereum Improvement Proposals. [EIP-712: Typed structured data hashing and signing](https://eips.ethereum.org/EIPS/eip-712). Created 2017-09-12.
14. OpenZeppelin. [Governance](https://docs.openzeppelin.com/contracts/5.x/api/governance). Contracts 5.x; undated.
15. Ethereum.org. [Bridges](https://ethereum.org/developers/docs/bridges/). Undated.
16. Ethereum.org. [Maximal extractable value (MEV)](https://ethereum.org/developers/docs/mev/). Undated.
17. Solana. [CPI Execution and Privileges](https://solana.com/docs/core/cpi/cpi-execution). Undated.
18. Sui. [Move Concepts](https://docs.sui.io/develop/write-move/sui-move-concepts). Undated.
19. Ethereum.org. [Nodes and Clients](https://ethereum.org/developers/docs/nodes-and-clients/). Undated.


## Hardware & firmware

[Read the associated chapter](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/hardware.html).

All sources accessed 2026-09-11. Undated pages are live references. OWASP citations point to the guide’s official maintained source files.

1. Intel / Intigriti. [Intel Bug Bounty Program](https://app.intigriti.com/programs/intel/intel/detail). Undated, current program terms.
2. OWASP. [ISTG: Attacker Model](https://github.com/OWASP/owasp-istg/blob/main/src/02_framework/attacker_model.md). Undated.
3. OWASP / Aaron Guzman. [Firmware Security Testing Methodology](https://github.com/scriptingxss/owasp-fstm). Undated, maintained repository.
4. OWASP. [ISTG: Firmware Update Mechanism](https://github.com/OWASP/owasp-istg/blob/main/src/03_test_cases/firmware/firmware_update_mechanism.md). Undated.
5. Espressif. [Secure Boot v2](https://docs.espressif.com/projects/esp-idf/en/stable/esp32/security/secure-boot-v2.html). ESP-IDF stable, ESP32; undated.
6. Espressif. [Security Overview](https://docs.espressif.com/projects/esp-idf/en/stable/esp32/security/security.html). ESP-IDF stable, ESP32; undated.
7. OWASP. [ISTG: Installed Firmware](https://github.com/OWASP/owasp-istg/blob/main/src/03_test_cases/firmware/installed_firmware.md). Undated.
8. OWASP. [ISTG: Memory](https://github.com/OWASP/owasp-istg/blob/main/src/03_test_cases/memory/README.md). Undated.
9. OWASP. [ISTG: Internal Interfaces](https://github.com/OWASP/owasp-istg/blob/main/src/03_test_cases/internal_interfaces/README.md). Undated.
10. OWASP. [ISTG: Wireless Interfaces](https://github.com/OWASP/owasp-istg/blob/main/src/03_test_cases/wireless_interfaces/README.md). Undated.
11. ReFirm Labs. [Binwalk](https://github.com/ReFirmLabs/binwalk). Undated, maintained repository.
12. Tesla. [Product Security](https://www.tesla.com/legal/security). Undated, current policy.



## Expansion research

The reusable modules, vulnerability cards, and conditional ATT&CK references were researched on **12 September 2026**. Each module and card keeps primary citations beside the relevant procedure. The existing platform policies retain their original 11 September research date; check the live policy before testing. Examples are documentation-reviewed, not executed test results. ATT&CK associations are conditional editorial mappings and do not imply that MITRE has mapped each weakness to that technique.

- [Object, function, and property authorization](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/authz-matrix.html) — inline primary references and test prerequisites.

- [Authentication, recovery, federation, and session lifecycle](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/identity-session.html) — inline primary references and test prerequisites.

- [Trace input into queries, commands, and templates](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/injection-tracing.html) — inline primary references and test prerequisites.

- [Server-side fetching and network trust boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/ssrf-boundary.html) — inline primary references and test prerequisites.

- [Browser execution, cross-origin reads, and forged actions](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/browser-trust.html) — inline primary references and test prerequisites.

- [Uploads, downloads, paths, archives, and XML](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/file-boundaries.html) — inline primary references and test prerequisites.

- [Workflow invariants, replay, idempotency, and races](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/state-business-logic.html) — inline primary references and test prerequisites.

- [REST, GraphQL, gRPC, WebSocket, and SSE permission parity](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/api-protocols.html) — inline primary references and test prerequisites.

- [Proxy normalization, cache isolation, and request boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/proxy-cache.html) — inline primary references and test prerequisites.

- [OSS lab: pin, install, prove, reset](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/oss-lab-reproduction.html) — inline primary references and test prerequisites.

- [Source review: entry point to protected operation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/source-dataflow.html) — inline primary references and test prerequisites.

- [CI and releases: trace untrusted input into privileged work](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/supply-chain-ci.html) — inline primary references and test prerequisites.

- [Dependencies: from advisory match to reachable impact](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/dependency-reachability.html) — inline primary references and test prerequisites.

- [Libraries and parsers: bounded fuzzing to a minimal reproducer](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/parser-fuzzing.html) — inline primary references and test prerequisites.

- [Cloud IAM: trust, delegation and effective permissions](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/cloud-iam-boundaries.html) — inline primary references and test prerequisites.

- [Object storage, signed URLs and delivery boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/storage-delivery.html) — inline primary references and test prerequisites.

- [Container and Kubernetes isolation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/container-kubernetes.html) — inline primary references and test prerequisites.

- [Infrastructure configuration: from repository default to deployed impact](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/infrastructure-config.html) — inline primary references and test prerequisites.

- [DNS, TLS and email trust boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/dns-tls-mail.html) — inline primary references and test prerequisites.

- [Database, cache, queue and management service boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/network-service-boundaries.html) — inline primary references and test prerequisites.

- [Android components, intents and deep links](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/android-components.html) — inline primary references and test prerequisites.

- [iOS signing capabilities, links and protected data](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/ios-boundaries.html) — inline primary references and test prerequisites.

- [Client storage, logs, backup and transport trust](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/client-storage-transport.html) — inline primary references and test prerequisites.

- [Desktop IPC, Electron bridges and native protocols](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/desktop-ipc.html) — inline primary references and test prerequisites.

- [Update signatures, rollback and privileged installation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/update-integrity.html) — inline primary references and test prerequisites.

- [AI tools: input trust, execution identity and approvals](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/ai-tool-trust.html) — inline primary references and test prerequisites.

- [RAG isolation: ingestion, retrieval, citations and revocation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/rag-tenant-isolation.html) — inline primary references and test prerequisites.

- [Contract state: authorization, callbacks and accounting](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/smart-contract-state.html) — inline primary references and test prerequisites.

- [Contract signatures and oracles: context, freshness and units](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/contract-signatures-oracles.html) — inline primary references and test prerequisites.

- [Firmware update and boot trust: signed bytes, product binding and rollback](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/firmware-update.html) — inline primary references and test prerequisites.

- [Hardware interfaces: production debug access and protected data](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/hardware-interfaces.html) — inline primary references and test prerequisites.

- [MFA and passkeys: enrollment, proof, replacement, and recovery](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/authenticator-lifecycle.html) — inline primary references and test prerequisites.

- [OAuth, OIDC, and SAML: transaction binding and token trust](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/federation-token-trust.html) — inline primary references and test prerequisites.

- [Request values: duplicate parameters, parser conflicts and downstream queries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/request-value-parsing.html) — inline primary references and test prerequisites.

- [Webhooks and integration events: authenticity, tenant binding and replay](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/webhook-event-integrity.html) — inline primary references and test prerequisites.

- [GitLab pipelines: contribution, job token and runner boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/gitlab-pipeline-boundaries.html) — inline primary references and test prerequisites.

- [Azure and GCP: identity, delegation and storage access](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/azure-gcp-boundaries.html) — inline primary references and test prerequisites.

- [Browser extensions: message authority and document lifetime](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/extension-message-boundaries.html) — inline primary references and test prerequisites.

- [AI state: memory, resumed work, retries and private caches](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/ai-state-lifecycle.html) — inline primary references and test prerequisites.

- [Resource budgets and sensitive business flows](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/resource-budget-controls.html) — inline primary references and test prerequisites.


## Content review — 14 September 2026

All original chapters, shared modules and vulnerability cards were reviewed for gaps and accuracy. Selected primary references were rechecked; this does not redate every source above. Read the [review and updates](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/review.html) for new procedures, corrections, source limitations and scope. The current OWASP API Security 2023 overview and selected API1/API3/API4/API6 pages were successfully retrieved. Direct IBB/Google policy bodies and some hardware-source refreshes remained limited as described in the relevant chapters. No target tests were performed.