Review and updates

Content review: 14 September 2026. The review covered the existing chapters, all 31 original shared procedures, and all 119 original vulnerability cards. It checked missing test paths, technical accuracy, evidence thresholds, duplication, command defaults, taxonomy and selected current policies. The revised manual contains 40 shared procedures and 140 vulnerability families.

This is a review of the manual, not a security assessment of the hostnames in the uploaded inventory. Commands remain documentation-reviewed examples. No target testing was performed, and a catalog entry does not mean that a vulnerability exists on a target.

Nine new shared procedures#

Each addition includes prerequisites, a workflow, a command or inspection recipe, expected evidence, false-positive controls and completion checks. Canonical procedures are embedded in applicable playbooks, with reciprocal links from vulnerability cards.

The vulnerability catalog adds 21 families for these gaps and related client privacy/model-loading cases. Existing entries gain references to the new procedures; the catalog still does not claim to enumerate every possible vulnerability.

Corrections and deeper coverage#

• Classify the demonstrated root cause. The mapping guide now explains discouraged broad CWE entries, missing versus incorrect authorization, and the distinction between signature and token-context validation. Shell interpretation and shell-free argument injection have separate cards. CWE badges remain candidates, not automatic report assignments. MITRE mapping guidance.
• Preserve local command intent. Loopback curl examples explicitly bypass inherited proxy variables. Fuzzer examples terminate on selected undefined behavior so a recoverable diagnostic is not mistaken for a saved crashing test. These changes improve reproducibility; they do not establish exploitability. curl manual, Clang UBSan.
• Follow work beyond the first request. Existing modules now cover stored input reaching later interpreters, archive links and extraction filters, cache revalidation, SSRF connection identity/retries, account merging, SSO/SCIM lifecycle, SSE cursors and gateway permission parity. Read the individual procedure for the applicable version and controls.
• Complete the client and protocol context. Added native authentication and privacy comparisons, LDAP/SMB/SSH interpretation, and contract-wallet signature controls. Repeated certificate-validation and update-verification prose was consolidated into one comparison per card.
• Make coverage and retests concrete. The operating playbook now varies actor, object, lifecycle, timing, representation, integrations and budget. Templates record original reproductions, legitimate neighboring behavior, shared guards and queued/cached state separately.
• Keep downloads reusable. Markdown exports now contain text, tables, checklists and intact code blocks instead of interactive page markup. The complete download includes the canonical procedures once and links between its chapters; individual downloads link back to the website.

Policy and framework review#

The platform chapter adds submission-readiness checks, policy-change handling, broader Google product reporting routes and guidance for permitted historical Huntr records. It preserves distinctions between authorization, intake eligibility and possible payment.

The IBB funding pause is supported by the official Node.js notice. The direct IBB policy could not be reverified in this review, and some Google policy bodies remained inaccessible. Their limitations are stated beside the affected claims; no unavailable payout or eligibility rules were reconstructed. Node.js notice.

All 24 listed Enterprise ATT&CK technique IDs, names and tactics were checked against official MITRE references. The guide retains ATT&CK v19.2 terminology and evidence-dependent mappings. The new families have no automatic mapping merely because they are security weaknesses. ATT&CK mapping guide, MITRE versions.

Dates, limitations and ongoing maintenance#

Original chapters retain their 11 September 2026 research dates; the first expansion retains 12 September 2026. This review adds 14 September 2026 context for selected source checks and changes. It does not claim that every linked page was freshly retrieved. Some GitHub-hosted hardware references could not be refreshed; the hardware procedures were read, with no material correction identified in this pass.

Before applying the manual, match the exact product version, configuration and scope. Protocol and provider procedures describe boundaries to investigate, not uniform behavior across all deployments. Product-specific workflows, new platforms and future vulnerabilities will require additional entries.

Use the coverage record to distinguish untested, passed, finding, blocked and not applicable. A checked checklist item records work reviewed, not proof that an entire vulnerability family is absent.