Methods and decisions
Source IDs resolve in sources. Documented identifies the upstream practice; adaptation identifies this project's operational rule. Every action here uses supplied evidence and produces a plan; upstream commands are not executed.
| ID | Condition | Action | Observable check | Exception / conflict | Evidence and status |
|---|---|---|---|---|---|
| M1 | A system or asset is proposed for review | Record owner, scope, exclusions and permitted actions separately from discovery | Every asset has a scope status; missing scope is unresolved | Continue a provisional desk map while requesting missing authorization; no target contact | JH2, Setting Scope, documented; explicit permission ledger and desk-only boundary are adaptations |
| M2 | The map covers only the main application | Ask about changed, legacy, acquired and less-visible surfaces | Each candidate has a reason, source and ownership question | An acquisition or related domain does not expand scope; historical bounty policies are not current rules | JH1, 02_Discovery.md, documented discovery habit; authorization safeguard is adaptation |
| M3 | Application behavior or architecture evidence is available | Map entry points, roles, technologies and external references | A boundary names actor, data/action, recipient and authority | CSP/JS references may be third-party, obsolete or generated; no automatic traversal | JH1, 03_Mapping.md and Fast Testing Checklist.md, documented; AI/MCP/memory extension is adaptation |
| M4 | A heuristic flags a parameter or suspicious response | Keep it as a lead; name the manual verification and secure expectation | No vulnerability label without observed mechanism and impact; tested/untested tracked | Parameter names, 403s and lack of alerts cannot prove vulnerability or safety | JH2, HUNT Parameter Scanner and HUNT Testing Methodology, documented separation; status vocabulary is adaptation |
| M5 | Certificates, DNS or LLM-generated names suggest assets | Preserve origin; distinguish candidate existence, ownership and permission | Separate claim status, ownership evidence and scope status | Wildcard DNS, shared hosting, guesses and stale observations can invalidate an inference | JH3 generate_subdomains/resolve_subdomains; JH4 checkSSLKeyword; the evidence ladder is an adaptation of observed tool behavior |
| M6 | Roles or sensitive workflows differ | Build actor–operation–resource questions; prioritize authority crossings and coverage gaps | Each question has expected authorization, evidence, owner and stop condition | No cross-account interaction is executed; absent roles remain unknown | JH1, 09_Privledge_Logic_Transport.md, documented role comparisons; prioritization and test-plan fields are adaptations |
| M7 | A map or report will be handed off | Verify exact asset/URL references; distinguish observed facts, hypotheses and proposed corrections | Every priority links to the register; no copied domain or invented result | Historical reports can teach a mechanism but cannot establish a current failure | JH1, 01_Philosophy.md, documented report-template accuracy; register/retest contract is adaptation |
| M8 | The system includes ML, GenAI, retrieval or agents | Trace model inputs and tool authority, then hand off to DASF classification and control scoping | All applicable system types retained; AI extension labeled as adaptation | TBHM is web-security guidance, not an AI framework; no invented source mapping | Project adaptation; JH10 illustrates separate model, guardrail and application evaluation targets |
Tool selection without execution
Tools answer narrower questions than their marketing descriptions. A saved JavaScript parser can suggest endpoints; a network scraper sends requests; an LLM generator sends input to a model provider; an evaluation target can invoke a real application. State those data flows, pin the version and review dependencies before recommending a future experiment. No tool installation, credentials, scanning or provider call is part of this skill.
CSPReconGO is a useful source-review exercise: the inspected code matches header names containing csp, which does not match the standard Content-Security-Policy name. Its README also marks cross-run tracking as TODO (JH5). Do not present that snapshot as a verified CSP inventory tool.