Appendix C: References and Further Reading¶
This appendix consolidates every external source cited across the handbook, grouped by type for ease of reference.
Standards and Frameworks¶
- W3C Content Security Policy Level 3
- MDN: Subresource Integrity reference
- MDN: Content-Security-Policy report-to (Reporting API)
- W3C Trusted Types specification
- RFC 4033: DNS Security Introduction and Requirements
- RFC 6797: HTTP Strict Transport Security (HSTS)
- RFC 8659: DNS Certification Authority Authorization (CAA)
- CycloneDX specification overview
- SPDX overview (ISO/IEC 5962:2021)
- SPDX 3.0.1 specification
- Linux Foundation: SPDX 3 press release
- SLSA v1.2 specification
- SLSA v1.0: what's new (historical; superseded by v1.2)
- SLSA v1.2: what's new
- OpenSSF: SLSA v1.0 announcement (historical)
- NIST SP 800-218: Secure Software Development Framework (SSDF)
- NIST SP 800-218 final publication
- NIST SP 800-61 Revision 3: Incident Response Recommendations
- NTIA: Minimum Elements for a Software Bill of Materials (SBOM), per Executive Order 14028
- CISA: Minimum Requirements for Vulnerability Exploitability eXchange (VEX)
- SEC: Item 1.05 cybersecurity disclosure rule fact sheet
- Hogan Lovells: EU Cyber Resilience Act, preparing for vulnerability and incident reporting
- OpenSSF: SBOMs in the era of the CRA
- Reproducible Builds project: definition
- Debian Wiki: Reproducible Builds, About
- MITRE ATT&CK
- MITRE: AADAPT cyber threat framework for digital assets, fact sheet
- MITRE AADAPT public matrix (GitHub)
- FIRST: Exploit Prediction Scoring System (EPSS)
- OWASP Smart Contract Security (SCS) project home
- OWASP Web3 Attack Vectors Top 15
- OWASP Mobile Application Security (MASVS/MASTG)
- OWASP Cheat Sheet Series
- OWASP Cross-Site Scripting Prevention Cheat Sheet
Incidents and Case Studies¶
- Sansec: Polyfill.io supply chain attack disclosure, 25 June 2024
- Qualys: Polyfill.io supply chain attack, Cloudflare and Fastly mirrors
- Censys: Polyfill.io supply chain attack, web of compromised domains
- Ledger: letter from chairman and CEO Pascal Gauthier regarding the Ledger Connect Kit exploit, December 2023
- CISA Alert AA25-266A: widespread supply chain compromise impacting the npm ecosystem (Shai-Hulud worm)
- CISA: supply chain compromise of tj-actions/changed-files, CVE-2025-30066, March 2025
- Codecov: April 2021 Bash Uploader post-mortem
- npm blog: details about the event-stream incident
- Aikido Security: npm debug and chalk packages compromised
- BleepingComputer: popular npm library (ua-parser-js) hijacked to install password stealers and miners
- Nx: s1ngularity attack on the Nx build system, postmortem
- Trail of Bits: supply chain attacks are exploiting our assumptions (XZ Utils backdoor)
- Google Cloud: 3CX software supply chain compromise
- Alex Birsan: dependency confusion, how I hacked into Apple, Microsoft, and dozens of other companies (2021)
- The Register: British Airways breach of 2018, ICO fine
- PortSwigger Research: practical web cache poisoning (James Kettle)
Tools and Documentation¶
- OSV-Scanner (GitHub repository)
- OSV.dev documentation
- OSV.dev
- Google Security Blog: announcing OSV-Scanner V2
- Google blog: announcing OSV-Scanner V2 vulnerability scanning
- OpenSSF: detecting malicious packages using the OSV API
- GUAC (Graph for Understanding Artifact Composition)
- OpenSSF Scorecard (GitHub repository)
- OpenSSF: beyond scores, OpenSSF Scorecard granular structured results for custom policy enforcement
- OpenSSF: scaling up supply chain security, implementing Sigstore for container image signing
- Sigstore documentation
- Sigstore: cosign signing overview
- Sigstore blog: using rekor-monitor
- slsa-verifier (GitHub repository)
- diffoscope
- IPFS (InterPlanetary File System)
- npm docs: Trusted Publishers
- GitHub Changelog: npm trusted publishing with OIDC is generally available
- GitHub Changelog: GitHub Actions policy now supports blocking and SHA-pinning actions
- GitHub Docs: Actions security, secure use reference
- Microsoft Learn: threat modeling tool threats documentation
