All Battlecards
REFLEX Battlecards
Attack scenarios and defense strategies organized by the REFLEX framework.
Supply Chain & Dependencies
Python Ecosystem
Java Ecosystem
JavaScript & Node.js
Other Languages
AI/ML Security
- AI Cost Amplification Attacks
- AI Dependency Typosquatting
- AI Service Abuse (1)
- AI Service Abuse (2)
- AI in CI CD Pipelines
- Adversarial Input Attacks
- Data Poisoning Attacks (1)
- Data Poisoning Attacks (2)
- Data Poisoning Attacks (3)
- Dataset Supply Chain Attacks
- LLM Tooling Misuse
- Model Exfiltration and Theft
- Model Provenance and Evaluation Bypass
- Model Supply Chain Metadata Leaks
- Poisoned AI ML Models
- Prompt Injection in AI Systems
CI/CD Security
- Branch Protection and Codeowner Gaps
- Build Cache and Artifact Poisoning
- CircleCI and Travis Token Theft
- Cloud Metadata and SSRF in Builds
- Dev Container Post-Create Hooks
- Docker Socket and Privileged Builds
- GitHub Actions Workflow Poisoning
- GitHub OIDC Misconfiguration
- GitLab CI Runner Attacks
- Jenkins CI CD Compromise
Developer Environment
Infrastructure & Deployment
Supply Chain Integrity
Total: 64 Battlecards | Each battlecard follows the REFLEX framework: Reconnaissance, Evaluation, Fortify, Limit, Expose, Exercise
Social Engineering & Human Factors