# Primary research and transfer limits

- **James Kettle, PortSwigger — [Smashing the state machine](https://portswigger.net/research/smashing-the-state-machine).**
  A request can pass through intermediate application states that other operations can observe.
  Model transitions and shared state before selecting a concurrency experiment. Use final-state
  evidence and valid serial controls; the article is not permission for high-volume tests.
- **Sam Curry — [Subaru investigation](https://samcurry.net/hacking-subaru).**
  Product workflows and actual client requests informed the investigation; the research then traced
  additional application surfaces and server decisions. The reusable lesson is to follow reachable
  operations and concrete authority. Related hosts and accounts still need independent authorization.
- **OWASP — [Business logic testing](https://wstg.owasp.org/stable/4-Web_Application_Security_Testing/10-Business_Logic_Testing/).**
  Derive misuse cases from application rules, including ordering, limits and integrity checks.
  A generic payload list lacks the intended behavior needed to judge a business-logic finding.

Local summaries, retrieved 2026-10-13. These are historical cases and methodology references, not
current target selection, live testing authority, or evidence that the user's target is affected.