Tools & resources

How to use itList versions and installed plugins on your own system; compare checksums of Core and available plugins.

How to use itInstall in the test system and check your own plugin in the dashboard or through WP-CLI; verify results manually.

How to use itSet up in your plugin project and run after changes; review notices about unsafe patterns and deviations.

How to use itConsult the relevant chapters when reviewing forms, REST endpoints and database access.

How to use itUse as a reference when reviewing file access, database integration, sessions and deployment.

How to use itInstall in the project, set the analysis level and examine affected code paths using the findings.

How to use itAnalyze the project and configure taint analysis for security-relevant data flows.

How to use itRun composer audit in the project directory and compare affected packages and versions with the advisories.

How to use itWrite regression tests for permissions, input validation and fixed security bugs, and run them in CI.

How to use itInstall for an authorized website, define the scan scope and verify detected versions and findings.

How to use itStart a browser through ZAP, explore the application manually and review passive findings; agree on active testing separately.

How to use itRoute the test browser through the proxy, inspect your own requests and document reproducible findings.

How to use itConfigure as a proxy for your own test environment and inspect requests and responses.

How to use itRun against an authorized service and assess protocols, the certificate and supported methods.

How to use itCheck a publicly reachable domain you own and compare individual notices with your configuration.

How to use itRestrict use to explicitly authorized addresses and ports; compare results with the intended inventory.

How to use itCapture traffic in your own test environment and use filters for troubleshooting or incident analysis.

How to use itDefine data sources and scope for authorized domains and map discovered assets to the inventory.

How to use itAnalyze the repository with suitable rules and review matches in the context of the actual data flow.

How to use itApply to supported projects during the build and verify product and version mappings before assessing results.

How to use itCheck your own image or repository during the build and compare results with the packages actually used.

How to use itCheck the repository and CI pipeline; treat findings confidentially and replace affected credentials if needed.

How to use itAnalyze lockfiles or supported SBOMs in the project and update affected packages.

How to use itBefore using a dependency, read its individual checks and add your own maintenance and risk assessment.

How to use itGenerate an SBOM for releases and use it for dependency and vulnerability comparisons.

How to use itUse as a basis for discussing maintenance, testing and disclosure during a supplier assessment.

How to use itChoose a stable release and plan suitable tests for authentication, access control and configuration.

How to use itSelect requirements for development or review and document test results transparently.

How to use itUse as an introduction and communication aid; use WSTG and ASVS for more detailed testing.

How to use itDuring implementation and review, consult specific topics such as authentication, session management or XSS prevention.

How to use itExamine API endpoints and object permissions using the risk categories.

How to use itDocument data flows, trust boundaries and abuse scenarios together before implementation or a pentest.

How to use itLook up a CVE ID and check published references and affected products.

How to use itCheck the product, versions, CVSS and references; also consider vendor guidance and local configuration.

How to use itCompare your own affected products with the catalogue and derive prioritized actions.

How to use itRead the vector and its individual values, and add the context of your own system to the assessment.

How to use itUse the current value alongside evidence of exploitation and your own exposure to prioritize action.

How to use itClassify a vulnerability by its cause and use related patterns for code reviews.

How to use itSearch for a package or identifier and compare affected and fixed versions with the lockfile.

How to use itSelect suitable modules for applications and infrastructure and compare measures with existing controls.

How to use itCheck sector and company details against current BSI documents and clarify the individual classification.

How to use itConsult the directive text and the applicable national implementation for requirements and definitions.

How to use itUse the current situation report to assess threats and plan actions.

How to use itFor SOC 2 preparation, agree on control objectives and evidence with the responsible people and auditors.

How to use itStructure the current and target state and assign measures and responsibilities.

How to use itFor an ISMS, review the scope and requirements using the official standard and additional advice.

How to use itMap detection rules and investigation steps to specific techniques and check coverage in your own environment.

How to use itSelect suitable rules, adapt them to your log sources and SIEM, and test them.

How to use itConnect agents and log sources in a test environment and adapt alerts to your own environment.

How to use itRecord the incident, tasks and findings as a team and establish a traceable workflow.

How to use itCompare detection, containment, recovery and follow-up procedures with your own responsibilities.

How to use itFor affected products, check vendor guidance, indicators and concrete remediation steps.