ABZSECURE / SECURITY WORKBENCH
Understand the boundary.
Then plan the test.
Follow one fictional request from attack to decision to control ownership. Turn the lesson into a scoped plan—without mistaking a model, a checkbox or a saved note for evidence.
All identities and order records in the lab are fictional. The planner stores only this page's in-memory draft, not an evidence vault. Use non-sensitive descriptions and evidence references—not credentials, client data or captured traffic. Nothing is scanned or automatically saved. Page/asset/hosting requests still occur.
The local workbench is initialising. If controls do not appear, the static guidance, scope checklist and contact links remain available. No information has been submitted.
Only this tool's schema/content version is accepted, maximum 128 KB. Imports are read locally. Invalid files leave your current draft intact; a valid import replaces it after confirmation. Close/reload loses unsaved work.
Synthetic demonstration—not a client assessment. Editing the sample retains this label. “Start a blank plan” creates an unlabelled user draft; the lab remains synthetic in every mode.
01 / ATTACK → DEFEND → GOVERN
One object. One decision.
Policy: an active credential may read its own object, or a manager may read another object within the same tenant. The vulnerable model deliberately skips tenant and ownership checks. Both reject revoked credentials.
ATTACK / FICTIONAL REQUEST
What was requested?
DEFEND / DECISION TRACE
No hidden checks.
Highlighting is optional. Every step remains readable, with the same information when motion is reduced.
Synthetic event:
DEFEND / ORIGINAL PSEUDOCODE
The fixed boundary
GOVERN / OWNERSHIP AND EVIDENCE
The next review
This changes only a planned method. It does not create a finding, evidence review or retest result.
Inspect all nine fixed-model regression cases
These are repeated synthetic decisions, not tests against your systems or proof of a production fix. They do not change the independent retest fields in your plan.
| Case | Expected | Model decision |
|---|
02 / AUTHORISED ASSESSMENT PLANNING
A scope before a finding.
Six original planning objectives, not a complete ASVS/WSTG checklist. ASVS describes verification requirements; WSTG describes testing guidance. Select the actual editions, chapters and coverage during scoping. A declaration is not verified authority or evidence.
Requirement → method → declared observation → separate retest
Planned, not tested, inconclusive and not applicable remain distinct. “No finding observed” is not “secure”. Record a rationale for exclusions and a separate evidence reference for a claimed retest.
03 / THE RECORD YOU CAN REVIEW
Planning and observation draft
Open questions and conflicts
JSON saves the versioned input recipe and declared records so results can be recomputed. CSV includes the current scope, simulated trace, original objectives/methods, declared findings, independent retest states and limitations. Review exports before sharing; files may become sensitive when you add real context.
METHOD / SOURCES / BOUNDARIES
Useful because the limits stay visible.
What does the lab actually execute?
A deterministic JavaScript state model over three fictional identities and three objects. It performs no HTTP requests, authentication, attacks or target scans. The output is a teaching trace, not measured application behaviour. All controls are keyboard-operated; replay is repeatable.
Requirements are not testing methods.
The six objectives and method descriptions here are original ABZSECURE planning aids. They are not copied standard clauses, complete coverage or official IDs. OWASP ASVS provides verification requirements; the OWASP WSTG provides testing guidance. Record the actual source editions and applicable references in your scoped plan before work. No OWASP endorsement is implied.
What if a record is incomplete or contradictory?
It stays a draft. Missing rationale, claimed observations without references and retest outcomes without an original finding are called out, not silently corrected into success. Completing a plan item does not change any real system. This public tool cannot validate the evidence references you type.
Where is my information?
In this page's memory until you close or reload, unless you explicitly import, download or print. No automatic local storage, telemetry of answers, scan, cloud integration or mail API is used by this module. Normal website requests still reach the host. Treat exported files according to your organisation's rules; no secrets or client evidence belong here.
A HUMAN ASSESSMENT IS SEPARATELY SCOPED
Bring the decision. Agree the boundary.
ABZSECURE can help define an authorised assessment, review a report or plan a retest. This contact link sends no answers, files, actor choices or scope content.