For injection attacks (SQLi, SSTI, SSRF, XXE, command injection, PHP type juggling, PHP file inclusion), see server-side.md. For deserialization attacks (Java, Pickle) and race conditions, see ...

These tools build views of retained research evidence. They are not code for the independent application and must not be included in a clean implementation handoff. tools/ on main is the only home for ...