blitzstrike 2.4.108 → 2.4.109

package/CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.109] — 2026-09-17
+
+### Changed — follow-the-money doctrine rule with concrete proven patterns
+
+- Extended the `follow_money` doctrine rule with the two proven business-logic
+  shapes behind real payouts: (1) a password-reset logic flaw that resets an
+  arbitrary account → account takeover; (2) a credit/invite business-logic flaw
+  that lets the client mint its own credits/quota → free money without payment.
+  Reinforces "if the client can add credits, apply a discount, or reset a
+  credential client-side, that is the highest-value test in the program."
+
 ## [2.4.108] — 2026-09-17
 
 ### Added — surface-first map (attack surface → high-value tests)

package/dist/index.js

@@ -61475,7 +61475,7 @@ var HUNTING_DOCTRINE = [
   {
     id: "follow_money",
     title: "Follow the Money",
-    rule: "Billing / credits / refunds / wallet flows have the most developer shortcuts. Price manipulation, payment races, quota bypass = high ROI."
+    rule: "Billing / credits / refunds / wallet flows have the most developer shortcuts. Price manipulation, payment races, quota bypass = high ROI. Proven pattern: a password-reset logic flaw that resets an arbitrary account = account takeover; a business-logic flaw in a credit/invite flow that lets the client mint its own credits/quota = free money without payment. If the app lets you add credits, apply a discount, or reset a credential client-side, that is the highest-value test in the program."
   },
   {
     id: "less_saturated",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.108",
+  "version": "2.4.109",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {