Checklists

349 cards across 30 categories.

One Markdown file per card. Browse a category folder, or use index/catalog.json for the live UI.

Category	Cards
API Security	18
Authentication / Password Reset	38
Broken Access Control / IDOR	53
Business Logic	31
Cache Poisoning	2
CORS Misconfiguration	3
Denial of Service	3
File Upload / Stored XSS	3
General Web Security	12
Host Header Injection	2
HTTP Request Smuggling	1
IDOR	8
Information Disclosure	12
Injection (SQL / NoSQL)	28
Mass Assignment	3
Methodology / Tooling	8
Mobile / JS Bridge	5
OAuth / SSO	11
Open Redirect / CSRF	3
Path Traversal / Arbitrary File Read	5
Privilege Escalation	12
Prompt Injection / AI Agent	1
Race Condition	6
RCE / Code Execution	23
Recon / OSINT	22
SSRF	10
SSRF, Host Header Injection	1
Subdomain Takeover	3
XSS	19
XXE / XML	3