Sources and research notes

Primary documentation, program policies, maintainers’ publications and official tool references underpin this manual. Sources were accessed on 11 September 2026. The working frameworks, milestones, priorities and test designs are analytical recommendations unless explicitly attributed to a program requirement.

How to read the evidence#

Program policy is time-sensitive. Check the exact asset, current intake, supported release, testing method, researcher eligibility and reward conditions before starting a new hunt. Undated documentation is a living reference, not a guarantee that an older deployment implements the same behavior. Archived Apple material is identified as historical; current MCP guidance is explicitly versioned.

Some Google OSS policy content was not fully extractable. The platform chapter marks this limitation and does not reconstruct missing reward tiers. Some OWASP pages failed to render; where available, citations use their official source repositories. No live targets were tested. Tool examples are documentation-reviewed recipes, not execution results. The uploaded all.txt supports only the local inventory counts stated in the scope chapter.

Reference inventory#

The sections below retain publishers, exact links, dates or versions, and claim context from the individual chapters. Some sources occur in more than one branch because they support different decisions.

Roadmap#

Read the associated chapter.

• PortSwigger. Web Security Academy. Live training catalog; undated; accessed 11 September 2026. Used for the lab resource recommendation.
• OWASP Foundation. Juice Shop. Live project documentation; accessed 11 September 2026. Used for intentionally vulnerable application practice.
• OWASP Foundation. crAPI. Undated project documentation; accessed 11 September 2026. Used for API-specific practice.

Platforms & participation#

Read the associated chapter.

Original registry accessed 2026-09-11. A selective follow-up review on 2026-09-14 rechecked the participation mechanics and policy-sensitive claims described above. “Undated/current” records the original retrieval context; it does not certify every program’s present intake. Google’s dynamic policy bodies and the direct IBB policy body could not be reverified. Search-index information is labeled where used, and no inaccessible page is treated as proof that a program closed or reopened.

Scope model#

Read the associated chapter.

• Foudil, E., and Y. Shafranovich / IETF. RFC 9116: A File Format to Aid in Security Vulnerability Disclosure. April 2022; accessed 11 September 2026. Used for security.txt location, scope and lack of implied testing permission.
• HackerOne. Gold Standard Safe Harbor Statement. 11 August 2025; accessed 11 September 2026. Used for third-party and policy-compliance limits.
• Uploaded all.txt. Local supplied copy; accessed 11 September 2026. Used only for line-level inventory analysis; no public URL or authorization evidence.

Operating playbook#

Read the associated chapter.

• FIRST. CVSS v4.0 Specification Document, document version 1.2; accessed 11 September 2026. Used for severity characteristics and metric groups.
• FIRST. CVSS v4.0 User Guide, version 1.2, 14 November 2025; accessed 11 September 2026. Used for Base severity versus risk and score/vector presentation.
• CVE Program. CNA Operational Rules, version 4.1.0, effective 14 May 2025; accessed 11 September 2026. Used for CVE/CNA coordination context.

OSS & self-hosted#

Read the associated chapter.

All sources were accessed on 2026-09-11. Unless a date is listed, the cited documentation is undated/living documentation; tool and service behavior must be checked again when used.

Web & API#

Read the associated chapter.

All sources accessed 2026-09-11. “Undated” means no reliable publication date was established; it does not imply old content. Sources were read directly. This chapter's test budgets, matrices, ordering and stopping rules are synthesis, not quotations from those sources.

Review update, 14 September 2026: the official OWASP API Security Top 10 2023 overview, BOLA and object-property authorization pages were successfully retrieved. Original source-registry access dates remain historical.

Network services#

Read the associated chapter.

All accessed 2026-09-11. Undated means a reliable publication date was not established. RFCs below substantiate protocol mechanics, not a claim that no later updating RFC exists.

Mobile#

Read the associated chapter.

All sources accessed 2026-09-11. “Undated” means no reliable publication/update date was established from the retrieved page. Dates are page metadata, not a guarantee of completeness for every current OS version. Archived Apple sources are used for established mechanisms and command syntax, not blanket claims about current platform enforcement.

Desktop & extensions#

Read the associated chapter.

All sources accessed 2026-09-11. “Undated” means no reliable publication/update date was established from the retrieved page. Dates are page metadata, not a guarantee of completeness for every current OS version. Archived Apple sources are used for established mechanisms and command syntax, not blanket claims about current platform enforcement.

Cloud & containers#

Read the associated chapter.

All accessed 11 September 2026. Match living documentation to the target version.

AI, agents & MCP#

Read the associated chapter.

All accessed 11 September 2026. Match living documentation to the target version.

Web3 & protocols#

Read the associated chapter.

All sources accessed 2026-09-11. Documentation pages are undated unless noted; versioned documentation must be matched to the target’s actual dependency version.

1. Immunefi. Rules. Undated, current rules.
2. Immunefi. Immunefi Bug Bounty: Information. Undated, current program example.
3. Foundry. Fork Testing. Undated; search index displays 2026-08-28.
4. Foundry. Testing. Undated; search index displays 2026-07-09.
5. Foundry. forge test. Undated CLI reference.
6. Foundry. Invariant Testing. Undated.
7. Trail of Bits / Crytic. Slither Usage. Edited 2024-07-23.
8. OpenZeppelin. Proxy. Contracts 5.x; undated.
9. Solidity. Security Considerations. Rolling development documentation; undated.
10. Chainlink. Data Feeds API Reference. Undated.
11. Chainlink. L2 Sequencer Uptime Feeds. Undated.
12. OpenZeppelin. ERC-4626. Contracts 5.x; undated.
13. Ethereum Improvement Proposals. EIP-712: Typed structured data hashing and signing. Created 2017-09-12.
14. OpenZeppelin. Governance. Contracts 5.x; undated.
15. Ethereum.org. Bridges. Undated.
16. Ethereum.org. Maximal extractable value (MEV). Undated.
17. Solana. CPI Execution and Privileges. Undated.
18. Sui. Move Concepts. Undated.
19. Ethereum.org. Nodes and Clients. Undated.

Hardware & firmware#

Read the associated chapter.

All sources accessed 2026-09-11. Undated pages are live references. OWASP citations point to the guide’s official maintained source files.

1. Intel / Intigriti. Intel Bug Bounty Program. Undated, current program terms.
2. OWASP. ISTG: Attacker Model. Undated.
3. OWASP / Aaron Guzman. Firmware Security Testing Methodology. Undated, maintained repository.
4. OWASP. ISTG: Firmware Update Mechanism. Undated.
5. Espressif. Secure Boot v2. ESP-IDF stable, ESP32; undated.
6. Espressif. Security Overview. ESP-IDF stable, ESP32; undated.
7. OWASP. ISTG: Installed Firmware. Undated.
8. OWASP. ISTG: Memory. Undated.
9. OWASP. ISTG: Internal Interfaces. Undated.
10. OWASP. ISTG: Wireless Interfaces. Undated.
11. ReFirm Labs. Binwalk. Undated, maintained repository.
12. Tesla. Product Security. Undated, current policy.

Expansion research#

The reusable modules, vulnerability cards, and conditional ATT&CK references were researched on 12 September 2026. Each module and card keeps primary citations beside the relevant procedure. The existing platform policies retain their original 11 September research date; check the live policy before testing. Examples are documentation-reviewed, not executed test results. ATT&CK associations are conditional editorial mappings and do not imply that MITRE has mapped each weakness to that technique.

• Object, function, and property authorization — inline primary references and test prerequisites.

• Authentication, recovery, federation, and session lifecycle — inline primary references and test prerequisites.

• Trace input into queries, commands, and templates — inline primary references and test prerequisites.

• Server-side fetching and network trust boundaries — inline primary references and test prerequisites.

• Browser execution, cross-origin reads, and forged actions — inline primary references and test prerequisites.

• Uploads, downloads, paths, archives, and XML — inline primary references and test prerequisites.

• Workflow invariants, replay, idempotency, and races — inline primary references and test prerequisites.

• REST, GraphQL, gRPC, WebSocket, and SSE permission parity — inline primary references and test prerequisites.

• Proxy normalization, cache isolation, and request boundaries — inline primary references and test prerequisites.

• OSS lab: pin, install, prove, reset — inline primary references and test prerequisites.

• Source review: entry point to protected operation — inline primary references and test prerequisites.

• CI and releases: trace untrusted input into privileged work — inline primary references and test prerequisites.

• Dependencies: from advisory match to reachable impact — inline primary references and test prerequisites.

• Libraries and parsers: bounded fuzzing to a minimal reproducer — inline primary references and test prerequisites.

• Cloud IAM: trust, delegation and effective permissions — inline primary references and test prerequisites.

• Object storage, signed URLs and delivery boundaries — inline primary references and test prerequisites.

• Container and Kubernetes isolation — inline primary references and test prerequisites.

• Infrastructure configuration: from repository default to deployed impact — inline primary references and test prerequisites.

• DNS, TLS and email trust boundaries — inline primary references and test prerequisites.

• Database, cache, queue and management service boundaries — inline primary references and test prerequisites.

• Android components, intents and deep links — inline primary references and test prerequisites.

• iOS signing capabilities, links and protected data — inline primary references and test prerequisites.

• Client storage, logs, backup and transport trust — inline primary references and test prerequisites.

• Desktop IPC, Electron bridges and native protocols — inline primary references and test prerequisites.

• Update signatures, rollback and privileged installation — inline primary references and test prerequisites.

• AI tools: input trust, execution identity and approvals — inline primary references and test prerequisites.

• RAG isolation: ingestion, retrieval, citations and revocation — inline primary references and test prerequisites.

• Contract state: authorization, callbacks and accounting — inline primary references and test prerequisites.

• Contract signatures and oracles: context, freshness and units — inline primary references and test prerequisites.

• Firmware update and boot trust: signed bytes, product binding and rollback — inline primary references and test prerequisites.

• Hardware interfaces: production debug access and protected data — inline primary references and test prerequisites.

• MFA and passkeys: enrollment, proof, replacement, and recovery — inline primary references and test prerequisites.

• OAuth, OIDC, and SAML: transaction binding and token trust — inline primary references and test prerequisites.

• Request values: duplicate parameters, parser conflicts and downstream queries — inline primary references and test prerequisites.

• Webhooks and integration events: authenticity, tenant binding and replay — inline primary references and test prerequisites.

• GitLab pipelines: contribution, job token and runner boundaries — inline primary references and test prerequisites.

• Azure and GCP: identity, delegation and storage access — inline primary references and test prerequisites.

• Browser extensions: message authority and document lifetime — inline primary references and test prerequisites.

• AI state: memory, resumed work, retries and private caches — inline primary references and test prerequisites.

• Resource budgets and sensitive business flows — inline primary references and test prerequisites.

Content review — 14 September 2026#

All original chapters, shared modules and vulnerability cards were reviewed for gaps and accuracy. Selected primary references were rechecked; this does not redate every source above. Read the review and updates for new procedures, corrections, source limitations and scope. The current OWASP API Security 2023 overview and selected API1/API3/API4/API6 pages were successfully retrieved. Direct IBB/Google policy bodies and some hardware-source refreshes remained limited as described in the relevant chapters. No target tests were performed.