Sources and attribution

Inspected 2026-10-23. These records distinguish repository ownership, authorship and curation. The user selected Jason Haddix as the practitioner reference. Published methods and coauthored tooling demonstrate public practice; they do not establish measured security outcomes for this skill.

JH1 — tbhm

Attribution: Jason Haddix; checklist also credits The Web Application Hacker's Handbook.
Fixed revision: 8babc58da364.
Inspected: README; Philosophy, Discovery, Mapping, Authorization and Session, Privilege/Logic/Transport, Fast Testing Checklist.
License evidence: No license file found in the inspected tree; do not redistribute the checklist or slides.

JH2 — HUNT

Attribution: JP Villanueva and Jason Haddix; upstream bugcrowd/HUNT.
Fixed revision: f15c4e5257e4.
Inspected: README, author credits, scanner versus methodology, scope, passive coverage limits.
License evidence: Apache-2.0 reported by API and README; source code was not imported.

JH3 — SubreconGPT

Attribution: jhaddix repository.
Fixed revision: 7f9f819f1a2f.
Inspected: README and subrecongpt.py.
License evidence: README claims MIT but the inspected tree has no LICENSE file; metadata license is null.

JH4 — awsScrape

Attribution: jhaddix repository.
Fixed revision: fcec86bf6a04.
Inspected: README and awsscrape.go.
License evidence: No detected license; source code was not imported.

JH5 — CSPReconGO

Attribution: jhaddix repository.
Fixed revision: 9d4665840e6f.
Inspected: README and CspReconGo.go.
License evidence: No detected license; source code was not imported.

JH6 — devops-attack-surface

Attribution: jhaddix collection; README credits Tom and Colbert from Accenture/FusionX.
Fixed revision: f7f7ebc4273f.
Inspected: README and repository tree only; HTML tool entries not independently verified.
License evidence: README claims MIT; API reports no license and tree contains no license file.

JH7 — pentest-bookmarks

Attribution: Collection started by Jason Haddix.
Fixed revision: 1ebdb91f0c41.
Inspected: README only; downstream bookmarks not verified.
License evidence: No detected license; no collection imported.

JH8 — bug-bounty-reference

Attribution: ngalongc; jhaddix fork.
Fixed revision: e98619d21ac5.
Inspected: README writeup index; one linked primary report inspected separately as JH13.
License evidence: No detected license; linked authors retain attribution.

JH9 — research

Attribution: Rafal Janicki (bl4de); jhaddix fork.
Fixed revision: 638bb4157805.
Inspected: README and hidden_directories_leaks/README.md; text inspected, screenshots not independently validated.
License evidence: No detected license; no code, screenshots or sample data imported.

JH10 — spikee

Attribution: Reversec Labs, formerly WithSecure Consulting; jhaddix fork.
Fixed revision: 524cd3a694b6.
Inspected: Fork README v0.1 and upstream README v0.9.2; no tests executed.
License evidence: Fork contains LICENSE-2.0.txt; current upstream API reports Apache-2.0.

JH11 — LinkFinder

Attribution: GerbenJavado/LinkFinder; jhaddix fork.
Fixed revision: 31b92ef62be7.
Inspected: README only.
License evidence: MIT detected; no code imported.

JH12 — disclosure-policy

Attribution: Bugcrowd and CipherLaw; jhaddix fork.
Fixed revision: eaa7c5715534.
Inspected: README only; no legal interpretation or current program-policy verification.
License evidence: README states CC BY 4.0; API license field is null.

JH10 current upstream: ReversecLabs/spikee README. The inspected fork is a historical snapshot; its API names and feature set must not be substituted for the current upstream documentation. Version strings above are README declarations, not installed versions.

Jack Whitton, Obtaining Login Tokens for an Outlook, Office or Azure Account, published 2016-04-03, inspected 2026-10-23. Read the authentication flow, URL-parsing explanation, reported fix and disclosure timeline. The author reports remediation in January 2016. This is a historical third-party case found via JH8, not a Jason Haddix finding or a reproduced result. Original explanatory summary only; no payload or screenshot copied.

Interpretation boundaries

Core practitioner methods: JH1 and coauthored JH2. The two review lenses share these origins; they are not independent expert reviews.
Project adaptations: authorization/ownership ledger, claim statuses, private output contract, AI/MCP/memory extension, proposed-check stop conditions and DASF handoff. These are not represented as Jason's own AI framework.
Tools were read, not installed or executed. Repository age, stars and fork presence are not measures of effectiveness or endorsement. A null license API field does not prove that no license exists; the file and README checks above are narrower observations.
No upstream code, long checklist, slide deck, credential list, leaked prompt corpus or raw case evidence is redistributed. Knowledge in this package is original synthesis with links; upstream terms remain applicable to upstream material.
CloudRecon appeared in repository metadata, but the branches endpoint returned an empty list and the advertised main branch returned 404. Its functionality was not inspected or inferred from the name.

See the study guide and inventory for selection decisions and coverage.