Source-review notes for PHP, Java, and ASP.NET stacks. See code-auditing for ordering.

Methodology

• source-sink-flow-analysis

PHP

• php-code-auditing
• php-magic-methods
• php-deserialization-gadgets
• dangerous-php-sinks

Java

• java-code-auditing
• java-deserialization-audit
• expression-injection
• dangerous-java-sinks

ASP.NET

• dangerous-aspnet-sinks

Source-provenance

• ghost-commit-smuggling