13 records / Open collection

Visual library.

Conceptual diagrams connecting identity, authority, data flow, and the cases behind them.

Search the collectionTopicSourceSort

13 matching records

A limited recovery request creates an account-bound challenge. Only valid, unexpired, unused proof permits a reset. Failure preserves account state; success consumes the challenge and notifies the owner.

Conceptual model Diagram

Recovery must preserve account ownership

Editorial conceptual model derived from the linked cases and official guidance; not a vendor architecture diagram or an exploitation sequence.

Reviewed 2026-10-02Read

User intent and untrusted connector content enter the AI workflow separately. A proposed action reaches an independent policy decision. Only an authorized state change proceeds; otherwise state remains unchanged.

Conceptual model Diagram

Retrieved content is data, not authority

Editorial conceptual model derived from the linked cases and official guidance; not a vendor architecture diagram or an exploitation sequence.

Reviewed 2026-10-02Read

Reviewed content and its immutable version are bound to an approval. Execution independently checks that the version still matches. Matching requests proceed with least privilege; mismatches require a new review.

Conceptual model Diagram

Approval stays attached to the reviewed version

Editorial conceptual model derived from the linked cases and official guidance; not a vendor architecture diagram or an exploitation sequence.

Reviewed 2026-10-02Read

An incoming browser message first passes origin, sender-context and format validation. A separate decision checks the operation and recipient. Failed checks reject the message without disclosure or state change. Approved content remains data and only the permitted action is performed.

Conceptual model Diagram

Browser messages need separate trust checks

Original defensive model combining OWASP messaging and authorization guidance with the linked historical cases. These are independent design checks, not a vendor patch diagram or an operational reproduction.

Reviewed 2026-10-02Read

Untrusted contributions remain separated from trusted build state. An artifact and its provenance reach a consumer policy gate. Only authenticated evidence matching the artifact and expected builder and inputs makes it eligible for release review; missing or mismatched evidence prevents promotion.

Conceptual model Diagram

Build evidence must match the artifact and trusted builder

Editorial conceptual model combining the Angular case with SLSA build guidance. The case supports separating automation trust and shared build state; the consumer verification gate is a general design synthesis, not a…

Reviewed 2026-10-03Read

A caller requests a combined view using required source A and required source B. Each source has its own authorization decision for that caller. Either No denies the combined view without protected source data. Both Yes decisions are required at an explicit AND gate before composition. Field selection preserves each source’s field permissions, and only permitted data is returned.

Conceptual model Diagram

Combined views preserve every source's access boundary

Original conceptual model for a view that requires multiple independently protected sources. Permission to use one source cannot authorize another source. The convergence is an AND requirement: both source decisions…

Reviewed 2026-10-04Read

A failure reaches a shared error handler. The public response contains minimal generic information. A separate diagnostic path selects useful context, removes secrets and unnecessary personal data, and stores it under access and retention controls. Raw exception details do not flow directly to the client.

Conceptual model Diagram

Failures need separate public and diagnostic contracts

Editorial conceptual model derived from the Facebook error-response case and OWASP error-handling and logging guidance. The case establishes unintended response disclosure and broader framework remediation; diagnostic…

Reviewed 2026-10-03Read

A failure retains the original caller, action and resource. An explicit access denial stops without protected data. A known recoverable operational failure can propose a fallback, but switching execution identity grants no extra caller entitlement. A separate application-policy decision evaluates that fallback for the original caller. Denied or indeterminate decisions stop without protected data. A permitted, scoped fallback returns only caller-permitted data.

Conceptual model Diagram

Fallbacks must preserve the original caller's authority

Original editorial defensive synthesis of the Instagram embedding disclosure and OWASP authorization guidance. The researcher attributes the disclosure to error handling that retrieved protected content under an…

Reviewed 2026-10-04Read

The identity provider authenticates a subject and binds issued claims to it. The relying application validates the issuer, audience, signature, and ownership binding before mapping to a local account. Failed validation is rejected.

Conceptual model Diagram

An identity claim must belong to the user

Editorial conceptual model derived from the linked cases and official guidance; not a vendor architecture diagram or an exploitation sequence.

Reviewed 2026-10-02Read

Untrusted input is parsed with memory safety and limited privileges. A bounded typed result still requires an independent meaning and authorization check before any scoped operation; failed checks reject the request.

Conceptual model Diagram

Parsing safety and action authority

Editorial conceptual model derived from the linked cases and official guidance; not a vendor architecture diagram or an exploitation sequence.

Reviewed 2026-10-02Read

A request enters a server-side caller, resource and operation authorization decision. Denial returns no protected data. Approval proceeds to explicit field selection before serialization. Only permitted, necessary fields cross into client-visible data. A separate consumer-context handling step keeps content, including generated text, from acquiring executable meaning before display. Browser rendering never supplies server authorization.

Conceptual model Diagram

Server disclosure and browser interpretation

Editorial conceptual model: assumes an application with server-side privileged data and a browser consumer. Next.js guidance supports server authorization and minimal client-visible contracts; OWASP LLM05 supports…

Reviewed 2026-10-03Read

A requested destination passes consistent parsing, application policy and independent network egress checks. Invalid input or either policy failure is rejected. Only an approved destination is requested.

Conceptual model Diagram

Layer server-request destination controls

Original conceptual defense-in-depth model linked to the historical Shopify Exchange case and OWASP guidance. It is not a vendor architecture diagram. Policy must fit the service’s destination requirements.

Reviewed 2026-10-02Read

A verified workload identity and a requested operation enter an independent authorization decision. Policy checks the role, action, resource and tenant together. Only the approved resource scope is allowed; other requests are denied. Both decisions produce an audit record.

Conceptual model Diagram

Keep workload authority tenant-scoped

Editorial conceptual model derived from the linked cases and official guidance; not a vendor architecture diagram or an exploitation sequence.

Reviewed 2026-10-02Read

GitHub snapshot 2026-10-04

53796974ace8 · JSON exports & schemas · CC BY 4.0 content / MIT software

`/`	Focus search on this page
`Ctrl` `K`	Search everything (command palette)
`1`-`9`	Library, Generator, Playbooks, Gadgets, Checklists, Payloads, Bypasses, Utilities, Reports
`0`	AI / MCP connector
`j` / `k`	Move selection down / up
`Enter`	Expand / open selected
`c`	Copy primary command of selected
`f`	Toggle favorite on selected tool
`Esc`	Clear search / close

Keyboard shortcuts