citation: audit-competition acceptance rates as complementary T9 signal#4
Open
holistis wants to merge 1 commit into
Open
citation: audit-competition acceptance rates as complementary T9 signal#4holistis wants to merge 1 commit into
holistis wants to merge 1 commit into
Conversation
Adds a new secondary citation (holistis2026auditaccept) plus a short, hedged 'Complementary signal' paragraph to T9.001, T9.004, T9.005, and T9.011 — the four techniques where the underlying data maps cleanly per OAK's own scope notes and OWASP crosswalk. The data: Sherlock audit-competition submission outcomes, restricted to the 10 of 105 crawled contests where results reconcile exactly against Sherlock's own published judging-repo structure (accepted + invalid === total submissions). The larger, unverified corpus is explicitly excluded rather than estimated. This is pre-deployment submission-acceptance data, not a claim about realized-incident frequency or detection coverage, and is presented as exactly that in each addition. Full methodology, limitations, and reproduction steps (public data only, no API dependency) are in the cited document. Verified locally: check_citations.py, check_linkage.py, check_backlinks.py, and markdownlint-cli2 all pass clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hi @iZonex — following up on #3. You asked for a T9-scoped cross-reference with a reproducible methodology and no API dependency, submitted as a PR against the T9 technique pages. Here it is.
What changed since #3
You caught two real problems: the free tool didn't resolve for installers, and the scope framing overstated overlap with T9. Both got fixed, but fixing the framing required first fixing the underlying data, which took a while — the acceptance-rate computation in our own crawler turned out to be wrong (confirmed on real samples, both under- and over-counting depending on the contest). I went looking for Sherlock's own ground truth (their judging-repo result folders, and separately their platform API) rather than patch the heuristic again.
Neither source could be reliably extended across the full 105-contest corpus we'd crawled, so rather than publish a corrected-but-still-uncertain number, this only uses the 10 contests where Sherlock's own accepted/invalid folder structure reconciles exactly against the total submission count. 95 contests are excluded, not estimated. Full writeup: https://github.com/holistis/bug-bounty-intelligence-mcp/blob/8c3e3084017cd7fa28be8a662012d28c41d33b8d/METHODOLOGY.md
What this PR adds
One
citations.bibentry (holistis2026auditaccept, no paid-service reference, points at the public methodology doc pinned to a commit SHA) and a short "Complementary signal" paragraph on the four T9 pages where the category mapping is unambiguous per your own scope notes and OWASP crosswalk:Each addition is explicit that this is pre-deployment submission-acceptance data, not a realized-incident claim, and not a detection-coverage claim — different epistemic category from what T9's worked examples document, presented as a separate signal rather than blended in.
Deliberately left out:
trusted-actor,overflow,dos-griefing,liquidation— your own T9 scope notes exclude these (operator-controlled behavior, integer over/underflow explicitly out of scope, no DoS/liquidation-cascade technique in T9). Also left outflash-loan(T9.002) — the mapped n dropped to 13 in the verified subset, too thin to cite.Verified locally
check_citations.py,check_linkage.py,check_backlinks.py,markdownlint-cli2— all pass clean.No pressure either way — if the four additions are too thin or not useful in this form, happy to adjust or drop any of them.