Differences

This shows you the differences between two versions of the page.

--- provenance:security:web_vulnerabilities [2026/08/27 13:50] – Log four review passes (3 focused empty, generic accepted); refresh report. Authored by Claude. karel.kubicek.claude
+++ provenance:security:web_vulnerabilities [2026/09/17 08:14] (current) – Qualify root Security links; Authored by Claude karel.kubicek.claude
@@ Line 9: / Line 9: @@
   * Review models requested by this sitting: **GPT 5.6 Luna medium** (''gpt-5.6-luna-medium'') for the three focused passes **and** the generic pass, instead of the spec's sonnet/fable split. Logged here so a later reader does not assume the default mix.
   * Corpus at run time: 5,859 extracted papers, 2010–2026, CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P. Read-only inputs under ''/workspace/publications_dataset/data/''.
-  * Read first: the wiki-measuretheweb spec (audience, currency, 5,859-paper corpus, provenance page, start link, bibtex), [[literature:corpus]], [[security]], [[practices:ethics]], [[practices:notifying_websites]], [[privacy:javascript]], [[programming:crawler:foxhound]], [[programming:interaction]], live ''start'' (already promised [[Security:Web vulnerabilities]]).
+  * Read first: the wiki-measuretheweb spec (audience, currency, 5,859-paper corpus, provenance page, start link, bibtex), [[literature:corpus]], [[:security]], [[practices:ethics]], [[practices:notifying_websites]], [[privacy:javascript]], [[programming:crawler:foxhound]], [[programming:interaction]], live ''start'' (already promised [[Security:Web vulnerabilities]]).
   * Target pages had no revision (''core.getPageInfo'' "does not exist"). ''dw.mjs pages'' does not list ''provenance:''. ''?do=export_raw'' on a missing page returns an HTML error document — that is not an existence test. This is a creation, not an extension.
   * Live ''start'' (rev 1787836787) already links the child; this sitting does not edit ''start''. Live ''security'' (rev 1787835259) still says all five children are red links — WRAP updated to name this child as written. Live [[Security:VirusTotal]] does **not** exist; the local draft of that page is not this item and is not claimed live.
@@ Line 22: / Line 22: @@
 | [[privacy:javascript]] | script behaviour without an exploitability claim | "is this live origin exploitable" |
 | [[security:headers]] | CSP/HSTS as crawlable artefacts (still unwritten) | payload-executed XSS |
-| [[security]] | schema populations for five children, including the 880 / 209 / 99 | the hand map of the 99 |
+| [[:security]] | schema populations for five children, including the 880 / 209 / 99 | the hand map of the 99 |
-A reasonable person might have treated the 99 as the population. That is the mistake the parent cell already forbids. Another might have written a nuclei/ZAP tool page; full-text union of nuclei/nikto/w3af/openvas is **24** papers — residue here, not a page (already rejected on [[security]]).
+A reasonable person might have treated the 99 as the population. That is the mistake the parent cell already forbids. Another might have written a nuclei/ZAP tool page; full-text union of nuclei/nikto/w3af/openvas is **24** papers — residue here, not a page (already rejected on [[:security]]).
 ===== Population and queries =====
@@ Line 142: / Line 142: @@
   * OWASP Top 10 **2017 A7** as the current XSS letter — superseded 2021 (A03) and 2025 (A05).
   * Chromium XSS Auditor as a 2026 defence to evaluate against.
-  * A nuclei / nikto / w3af / OpenVAS scanner-tool page — 24 full-text hits, already rejected on [[security]].
+  * A nuclei / nikto / w3af / OpenVAS scanner-tool page — 24 full-text hits, already rejected on [[:security]].
   * MDN / textbook explanations of ''X-Frame-Options'' to pad the clickjacking hole.
   * SEO "top web vulnerabilities 2026" listicles.
@@ Line 174: / Line 174: @@
 ===== Published code =====
-''pages/count_vuln_sites.py'' is byte-identical to the ''%%<file python count_vuln_sites.py>%%'' block. ''uv run python pages/count_vuln_sites.py --selftest'' OK. ''%%--demo%%'' output on 2026-08-27:
+''pages/count_vuln_sites.py'' is byte-identical to the ''%%<file python count_vuln_sites.py>%%'' block. ''uv run python pages/count_vuln_sites.py %%--selftest%%'' OK. ''%%--demo%%'' output on 2026-08-27:
 <code>
@@ Line 196: / Line 196: @@
 ^ Pass ^ Model ^ Findings ^ Disposition ^
-| 1. Figures vs script | GPT 5.6 Luna medium | none | **Accepted as empty.** Re-ran report, ''verify_web_vuln_figures.mjs'', page-number checks (windowed, whole-page, ''--code''), table/wrap guards, ''count_vuln_sites.py --demo/--selftest'', freeze byte-compare. |
+| 1. Figures vs script | GPT 5.6 Luna medium | none | **Accepted as empty.** Re-ran report, ''verify_web_vuln_figures.mjs'', page-number checks (windowed, whole-page, ''%%--code%%''), table/wrap guards, ''count_vuln_sites.py %%--demo%%/%%--selftest%%'', freeze byte-compare. |
 | 2. Citations and quotes | GPT 5.6 Luna medium | none | **Accepted as empty.** All 17 content-page keys resolve; eight additions unique; cover-paper figures present in ''paper.cols.txt''. |
 | 3. External currency | GPT 5.6 Luna medium | none | **Accepted as empty.** Re-fetched OWASP 2025, Chrome 78/80, ZAP Checkmarx blog, ''zaproxy/zaproxy'' licence Apache-2.0, nuclei not archived. |
@@ Line 879: / Line 879: @@
 </file>
+===== Markup sweep, 2026-09-17 =====
+Mechanical rendering repair only: a fresh live raw/XHTML export of 188 pages was checked with ''check_wrap.mjs'' and ''check_typography.mjs''. Affected plugin tags, CLI flags and heading markup were repaired; no figures or substantive prose were changed. The resulting source and rendered DOM were re-checked after saving.
+===== Link-hygiene sweep, 2026-09-17 =====
+The fresh rendered-DOM sweep found four bare ''security'' links resolving to ''provenance:security:security''. They are now root-anchored; the post-save DOM was re-checked for red links. No figures or citations changed.