vulns.co
/
GKData.io MCP

Back to Payloads

Second-order canaries

A harmless marker helps trace data that is stored first and processed later by exports, notifications, dashboards, or integrations. Test only accounts and records you control.

Tags: second-order, canary, stored, authorized-testing

Controlled probes

  • CANARY-<unique-id> in a non-sensitive text field
  • A unique callback URL only where a documented URL consumer exists
  • Track create time, reader surface, and observed callback; remove test data when permitted

Source: https://owasp.org/www-project-web-security-testing-guide/