penthera 1.7.0 → 1.8.0

package/docs/references.bib

@@ -1,559 +0,0 @@
-% Penthera bibliography, rendered in APA 7 style into references.md. Every entry verified 2026-10-19 against Crossref (publisher-deposited DOI metadata, including editors),
-% USENIX, NDSS, arXiv, RFC Editor, OWASP, MITRE, NIST, OASIS and the EU Publications Office.
-
-% ---------------------------------------------------------------- blackbox
-@inproceedings{bau2010state,
-  author    = {Bau, Jason and Bursztein, Elie and Gupta, Divij and Mitchell, John},
-  title     = {State of the Art: Automated Black-Box Web Application Vulnerability Testing},
-  booktitle = {2010 IEEE Symposium on Security and Privacy},
-  publisher = {IEEE},
-  year      = {2010},
-  pages     = {332--345},
-  doi       = {10.1109/SP.2010.27},
-  note      = {blackbox}
-}
-
-@inproceedings{doupe2010johnny,
-  author    = {Doup{\'e}, Adam and Cova, Marco and Vigna, Giovanni},
-  title     = {Why {Johnny} Can't Pentest: An Analysis of Black-Box Web Vulnerability Scanners},
-  booktitle = {Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA 2010)},
-  editor    = {Kreibich, Christian and Jahnke, Marko},
-  series    = {Lecture Notes in Computer Science},
-  publisher = {Springer},
-  year      = {2010},
-  pages     = {111--131},
-  doi       = {10.1007/978-3-642-14215-4_7},
-  note      = {blackbox}
-}
-
-@inproceedings{antunes2010benchmarking,
-  author    = {Antunes, Nuno and Vieira, Marco},
-  title     = {Benchmarking Vulnerability Detection Tools for Web Services},
-  booktitle = {2010 IEEE International Conference on Web Services (ICWS)},
-  publisher = {IEEE},
-  year      = {2010},
-  pages     = {203--210},
-  doi       = {10.1109/ICWS.2010.76},
-  note      = {blackbox}
-}
-
-@article{antunes2015assessing,
-  author    = {Antunes, Nuno and Vieira, Marco},
-  title     = {Assessing and Comparing Vulnerability Detection Tools for Web Services: Benchmarking Approach and Examples},
-  journal   = {IEEE Transactions on Services Computing},
-  volume    = {8},
-  number    = {2},
-  year      = {2015},
-  pages     = {269--283},
-  doi       = {10.1109/TSC.2014.2310221},
-  note      = {blackbox}
-}
-
-@misc{owaspbenchmark,
-  shorthand    = {OWASP Benchmark},
-  author       = {{OWASP Foundation}},
-  title        = {{OWASP Benchmark} Project},
-  version      = {1.2},
-  annote       = {OWASP project page; project leader Dave Wichers},
-  url          = {https://owasp.org/www-project-benchmark/},
-  urldate      = {2026-10-19},
-  note         = {blackbox}
-}
-
-@techreport{scarfone2008sp800115,
-  shorthand    = {NIST SP 800-115},
-  author      = {Scarfone, K. A. and Souppaya, M. P. and Cody, A. and Orebaugh, A. D.},
-  title       = {Technical Guide to Information Security Testing and Assessment},
-  institution = {National Institute of Standards and Technology},
-  type        = {NIST Special Publication},
-  number      = {800-115},
-  year        = {2008},
-  doi         = {10.6028/NIST.SP.800-115},
-  note        = {standards}
-}
-
-% ---------------------------------------------------------------- design
-@article{saltzer1975protection,
-  author  = {Saltzer, J. H. and Schroeder, M. D.},
-  title   = {The Protection of Information in Computer Systems},
-  journal = {Proceedings of the IEEE},
-  volume  = {63},
-  number  = {9},
-  year    = {1975},
-  pages   = {1278--1308},
-  doi     = {10.1109/PROC.1975.9939},
-  note    = {design}
-}
-
-% ---------------------------------------------------------------- threatmodel
-@book{shostack2014threat,
-  author    = {Shostack, Adam},
-  title     = {Threat Modeling: Designing for Security},
-  publisher = {Wiley},
-  year      = {2014},
-  isbn      = {978-1-118-80999-0},
-  url       = {https://www.wiley-vch.de/de/fachgebiete/computer-und-informatik/threat-modeling-978-1-118-80999-0},
-  note      = {threatmodel}
-}
-
-@misc{kohnfelder1999threats,
-  author       = {Kohnfelder, Loren and Garg, Praerit},
-  title        = {The Threats to Our Products},
-  titleaddon   = {Internal publication},
-  organization = {Microsoft},
-  annote       = {Microsoft internal \emph{Interface} journal, 1 April 1999; copy hosted by Adam Shostack},
-  year         = {1999},
-  url          = {https://shostack.org/files/microsoft/The-Threats-To-Our-Products.docx},
-  urldate      = {2026-10-19},
-  note         = {threatmodel}
-}
-
-% ---------------------------------------------------------------- supplychain
-@inproceedings{ladisa2023sok,
-  author    = {Ladisa, Piergiorgio and Plate, Henrik and Martinez, Matias and Barais, Olivier},
-  title     = {{SoK}: Taxonomy of Attacks on Open-Source Software Supply Chains},
-  booktitle = {2023 IEEE Symposium on Security and Privacy (SP)},
-  publisher = {IEEE},
-  year      = {2023},
-  pages     = {1509--1526},
-  doi       = {10.1109/SP46215.2023.10179304},
-  note      = {supplychain}
-}
-
-@inproceedings{ohm2020backstabber,
-  author    = {Ohm, Marc and Plate, Henrik and Sykosch, Arnold and Meier, Michael},
-  title     = {Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attacks},
-  booktitle = {Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA 2020)},
-  editor    = {Maurice, Cl{\'e}mentine and Bilge, Leyla and Stringhini, Gianluca and Neves, Nuno},
-  series    = {Lecture Notes in Computer Science},
-  publisher = {Springer},
-  year      = {2020},
-  pages     = {23--43},
-  doi       = {10.1007/978-3-030-52683-2_2},
-  note      = {supplychain}
-}
-
-@inproceedings{zimmermann2019small,
-  author    = {Zimmermann, Markus and Staicu, Cristian-Alexandru and Tenny, Cam and Pradel, Michael},
-  title     = {Small World with High Risks: A Study of Security Threats in the npm Ecosystem},
-  booktitle = {28th USENIX Security Symposium (USENIX Security 19)},
-  publisher = {USENIX Association},
-  year      = {2019},
-  pages     = {995--1010},
-  isbn      = {978-1-939133-06-9},
-  url       = {https://www.usenix.org/conference/usenixsecurity19/presentation/zimmerman},
-  note      = {supplychain}
-}
-
-@inproceedings{lauinger2017thou,
-  author    = {Lauinger, Tobias and Chaabane, Abdelberi and Arshad, Sajjad and Robertson, William and Wilson, Christo and Kirda, Engin},
-  title     = {Thou Shalt Not Depend on Me: Analysing the Use of Outdated {JavaScript} Libraries on the Web},
-  booktitle = {Proceedings 2017 Network and Distributed System Security Symposium},
-  publisher = {Internet Society},
-  year      = {2017},
-  doi       = {10.14722/ndss.2017.23414},
-  note      = {supplychain}
-}
-
-@article{thompson1984reflections,
-  author  = {Thompson, Ken},
-  title   = {Reflections on Trusting Trust},
-  journal = {Communications of the ACM},
-  volume  = {27},
-  number  = {8},
-  year    = {1984},
-  pages   = {761--763},
-  doi     = {10.1145/358198.358210},
-  note    = {supplychain}
-}
-
-@inproceedings{torresarias2019intoto,
-  author    = {Torres-Arias, Santiago and Afzali, Hammad and Kuppusamy, Trishank Karthik and Curtmola, Reza and Cappos, Justin},
-  title     = {{in-toto}: Providing farm-to-table guarantees for bits and bytes},
-  booktitle = {28th USENIX Security Symposium (USENIX Security 19)},
-  publisher = {USENIX Association},
-  year      = {2019},
-  pages     = {1393--1410},
-  isbn      = {978-1-939133-06-9},
-  url       = {https://www.usenix.org/conference/usenixsecurity19/presentation/torres-arias},
-  note      = {supplychain}
-}
-
-@inproceedings{samuel2010survivable,
-  author    = {Samuel, Justin and Mathewson, Nick and Cappos, Justin and Dingledine, Roger},
-  title     = {Survivable Key Compromise in Software Update Systems},
-  booktitle = {Proceedings of the 17th ACM Conference on Computer and Communications Security (CCS '10)},
-  publisher = {ACM},
-  year      = {2010},
-  pages     = {61--72},
-  doi       = {10.1145/1866307.1866315},
-  note      = {supplychain}
-}
-
-% ---------------------------------------------------------------- secrets
-@inproceedings{meli2019bad,
-  author    = {Meli, Michael and McNiece, Matthew R. and Reaves, Bradley},
-  title     = {How Bad Can It {Git}? Characterizing Secret Leakage in Public {GitHub} Repositories},
-  booktitle = {Proceedings 2019 Network and Distributed System Security Symposium},
-  publisher = {Internet Society},
-  year      = {2019},
-  doi       = {10.14722/ndss.2019.23418},
-  note      = {secrets}
-}
-
-@inproceedings{basak2023secretbench,
-  author    = {Basak, Setu Kumar and Neil, Lorenzo and Reaves, Bradley and Williams, Laurie},
-  title     = {{SecretBench}: A Dataset of Software Secrets},
-  booktitle = {2023 IEEE/ACM 20th International Conference on Mining Software Repositories (MSR)},
-  publisher = {IEEE},
-  year      = {2023},
-  pages     = {347--351},
-  doi       = {10.1109/MSR59073.2023.00053},
-  note      = {secrets}
-}
-
-% ---------------------------------------------------------------- web
-@inproceedings{weichselbaum2016csp,
-  author    = {Weichselbaum, Lukas and Spagnuolo, Michele and Lekies, Sebastian and Janc, Artur},
-  title     = {{CSP} Is Dead, Long Live {CSP}! On the Insecurity of Whitelists and the Future of {Content Security Policy}},
-  booktitle = {Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS '16)},
-  publisher = {ACM},
-  year      = {2016},
-  pages     = {1376--1387},
-  doi       = {10.1145/2976749.2978363},
-  note      = {web}
-}
-
-@inproceedings{kocher1996timing,
-  author    = {Kocher, Paul C.},
-  title     = {Timing Attacks on Implementations of {Diffie-Hellman}, {RSA}, {DSS}, and Other Systems},
-  booktitle = {Advances in Cryptology -- CRYPTO '96},
-  editor    = {Koblitz, Neal},
-  series    = {Lecture Notes in Computer Science},
-  publisher = {Springer},
-  year      = {1996},
-  pages     = {104--113},
-  doi       = {10.1007/3-540-68697-5_9},
-  note      = {web}
-}
-
-@article{crosby2009opportunities,
-  author  = {Crosby, Scott A. and Wallach, Dan S. and Riedi, Rudolf H.},
-  title   = {Opportunities and Limits of Remote Timing Attacks},
-  journal = {ACM Transactions on Information and System Security},
-  volume  = {12},
-  number  = {3},
-  year    = {2009},
-  pages   = {1--29},
-  doi     = {10.1145/1455526.1455530},
-  note    = {web}
-}
-
-@inproceedings{lekies2013flows,
-  author    = {Lekies, Sebastian and Stock, Ben and Johns, Martin},
-  title     = {25 Million Flows Later: Large-scale Detection of {DOM}-based {XSS}},
-  booktitle = {Proceedings of the 2013 ACM SIGSAC Conference on Computer and Communications Security (CCS '13)},
-  publisher = {ACM},
-  year      = {2013},
-  pages     = {1193--1204},
-  doi       = {10.1145/2508859.2516703},
-  note      = {web}
-}
-
-@inproceedings{stock2014precise,
-  author    = {Stock, Ben and Lekies, Sebastian and Mueller, Tobias and Spiegel, Patrick and Johns, Martin},
-  title     = {Precise Client-side Protection against {DOM}-based Cross-Site Scripting},
-  booktitle = {23rd USENIX Security Symposium (USENIX Security 14)},
-  publisher = {USENIX Association},
-  year      = {2014},
-  pages     = {655--670},
-  isbn      = {978-1-931971-15-7},
-  url       = {https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/stock},
-  note      = {web}
-}
-
-@inproceedings{barth2008robust,
-  author    = {Barth, Adam and Jackson, Collin and Mitchell, John C.},
-  title     = {Robust Defenses for Cross-Site Request Forgery},
-  booktitle = {Proceedings of the 15th ACM Conference on Computer and Communications Security (CCS '08)},
-  publisher = {ACM},
-  year      = {2008},
-  pages     = {75--88},
-  doi       = {10.1145/1455770.1455782},
-  note      = {web}
-}
-
-@inproceedings{fett2016comprehensive,
-  author    = {Fett, Daniel and K{\"u}sters, Ralf and Schmitz, Guido},
-  title     = {A Comprehensive Formal Security Analysis of {OAuth} 2.0},
-  booktitle = {Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS '16)},
-  publisher = {ACM},
-  year      = {2016},
-  pages     = {1204--1215},
-  doi       = {10.1145/2976749.2978385},
-  note      = {web}
-}
-
-@misc{hodges2012rfc6797,
-  author       = {Hodges, J. and Jackson, C. and Barth, A.},
-  title        = {{HTTP} Strict Transport Security ({HSTS})},
-  howpublished = {RFC 6797, Proposed Standard, RFC Editor},
-  year         = {2012},
-  month        = nov,
-  doi          = {10.17487/RFC6797},
-  note         = {web}
-}
-
-@misc{jones2015rfc7519,
-  author       = {Jones, M. and Bradley, J. and Sakimura, N.},
-  title        = {{JSON} Web Token ({JWT})},
-  howpublished = {RFC 7519, Proposed Standard, RFC Editor},
-  year         = {2015},
-  month        = may,
-  doi          = {10.17487/RFC7519},
-  note         = {web}
-}
-
-@misc{sakimura2015rfc7636,
-  author       = {Sakimura, N. and Bradley, J. and Agarwal, N.},
-  title        = {Proof Key for Code Exchange by {OAuth} Public Clients},
-  howpublished = {RFC 7636, Proposed Standard, RFC Editor},
-  year         = {2015},
-  month        = sep,
-  doi          = {10.17487/RFC7636},
-  note         = {web}
-}
-
-@misc{lodderstedt2025rfc9700,
-  author       = {Lodderstedt, T. and Bradley, J. and Labunets, A. and Fett, D.},
-  title        = {Best Current Practice for {OAuth} 2.0 Security},
-  howpublished = {RFC 9700, BCP 240, RFC Editor},
-  year         = {2025},
-  month        = jan,
-  doi          = {10.17487/RFC9700},
-  note         = {web}
-}
-
-@inproceedings{chen2018cors,
-  author    = {Chen, Jianjun and Jiang, Jian and Duan, Haixin and Wan, Tao and Chen, Shuo and Paxson, Vern and Yang, Min},
-  title     = {We Still Don't Have Secure Cross-Domain Requests: an Empirical Study of {CORS}},
-  booktitle = {27th USENIX Security Symposium (USENIX Security 18)},
-  publisher = {USENIX Association},
-  year      = {2018},
-  pages     = {1079--1093},
-  isbn      = {978-1-939133-04-5},
-  url       = {https://www.usenix.org/conference/usenixsecurity18/presentation/chen-jianjun},
-  note      = {web}
-}
-
-@misc{sheffer2020rfc8725,
-  author       = {Sheffer, Y. and Hardt, D. and Jones, M.},
-  title        = {{JSON} Web Token Best Current Practices},
-  howpublished = {RFC 8725, BCP 225, RFC Editor},
-  year         = {2020},
-  month        = feb,
-  doi          = {10.17487/RFC8725},
-  note         = {web}
-}
-
-@misc{owasp2023api,
-  shorthand    = {OWASP API Top 10:2023},
-  author       = {{OWASP Foundation}},
-  title        = {{OWASP Top 10} {API} Security Risks -- 2023},
-  organization = {OWASP API Security Project},
-  year         = {2023},
-  url          = {https://owasp.org/API-Security/editions/2023/en/0x11-t10/},
-  urldate      = {2026-10-19},
-  note         = {web}
-}
-
-@misc{kitterman2014rfc7208,
-  author       = {Kitterman, S.},
-  title        = {Sender Policy Framework ({SPF}) for Authorizing Use of Domains in Email, Version 1},
-  howpublished = {RFC 7208, Proposed Standard, RFC Editor},
-  year         = {2014},
-  month        = apr,
-  doi          = {10.17487/RFC7208},
-  note         = {web}
-}
-
-@misc{kucherawy2015rfc7489,
-  author       = {Kucherawy, M. and Zwicky, E.},
-  title        = {Domain-based Message Authentication, Reporting, and Conformance ({DMARC})},
-  howpublished = {RFC 7489, Informational, RFC Editor},
-  year         = {2015},
-  month        = mar,
-  doi          = {10.17487/RFC7489},
-  note         = {web}
-}
-
-@misc{owasp2021top10,
-  shorthand    = {OWASP Top 10:2021},
-  author       = {{OWASP Foundation}},
-  title        = {{OWASP Top 10}:2021},
-  year         = {2021},
-  url          = {https://top10.owasp.org/2021},
-  urldate      = {2026-10-19},
-  note         = {web}
-}
-
-@misc{owasp2025top10,
-  shorthand    = {OWASP Top 10:2025},
-  author       = {{OWASP Foundation}},
-  title        = {{OWASP Top 10}:2025},
-  year         = {2025},
-  url          = {https://top10.owasp.org/2025},
-  urldate      = {2026-10-19},
-  note         = {web}
-}
-
-@misc{owaspwstg42,
-  shorthand    = {OWASP WSTG v4.2},
-  author       = {{OWASP Foundation}},
-  title        = {{OWASP Web Security Testing Guide}, Version 4.2},
-  url          = {https://wstg.owasp.org/v4.2/},
-  urldate      = {2026-10-19},
-  note         = {web}
-}
-
-% ---------------------------------------------------------------- llm
-@inproceedings{greshake2023signed,
-  author        = {Greshake, Kai and Abdelnabi, Sahar and Mishra, Shailesh and Endres, Christoph and Holz, Thorsten and Fritz, Mario},
-  title         = {Not What You've Signed Up For: Compromising Real-World {LLM}-Integrated Applications with Indirect Prompt Injection},
-  booktitle     = {Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec '23)},
-  publisher     = {ACM},
-  year          = {2023},
-  pages         = {79--90},
-  doi           = {10.1145/3605764.3623985},
-  eprint        = {2302.12173},
-  archivePrefix = {arXiv},
-  note          = {llm}
-}
-
-@inproceedings{spracklen2025package,
-  author    = {Spracklen, Joseph and Wijewickrama, Raveen and Sakib, A H M Nazmus and Maiti, Anindya and Viswanath, Bimal and Jadliwala, Murtuza},
-  title     = {We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating {LLMs}},
-  booktitle = {34th USENIX Security Symposium (USENIX Security 25)},
-  publisher = {USENIX Association},
-  year      = {2025},
-  pages     = {3687--3706},
-  isbn      = {978-1-939133-52-6},
-  url       = {https://www.usenix.org/conference/usenixsecurity25/presentation/spracklen},
-  note      = {llm}
-}
-
-@misc{perez2022ignore,
-  author        = {Perez, F{\'a}bio and Ribeiro, Ian},
-  title         = {Ignore Previous Prompt: Attack Techniques For Language Models},
-  annote        = {Presented at the NeurIPS 2022 ML Safety Workshop},
-  year          = {2022},
-  eprint        = {2211.09527},
-  archivePrefix = {arXiv},
-  doi           = {10.48550/arXiv.2211.09527},
-  note          = {llm}
-}
-
-@misc{liu2023prompt,
-  author        = {Liu, Yi and Deng, Gelei and Li, Yuekang and Wang, Kailong and Wang, Zihao and Wang, Xiaofeng and Zhang, Tianwei and Liu, Yepang and Wang, Haoyu and Zheng, Yan and Zhang, Leo Yu and Liu, Yang},
-  title         = {Prompt Injection attack against {LLM}-integrated Applications},
-  annote        = {arXiv preprint},
-  year          = {2023},
-  eprint        = {2306.05499},
-  archivePrefix = {arXiv},
-  doi           = {10.48550/arXiv.2306.05499},
-  note          = {llm}
-}
-
-@misc{owasp2024llmtop10,
-  shorthand    = {OWASP LLM Top 10 (2025)},
-  author       = {{OWASP Foundation}},
-  title        = {{OWASP Top 10} for {LLM} Applications 2025},
-  organization = {OWASP Gen AI Security Project},
-  year         = {2024},
-  month        = nov,
-  day          = {17},
-  url          = {https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/},
-  urldate      = {2026-10-19},
-  note         = {llm}
-}
-
-@misc{owasp2025agentic,
-  shorthand    = {OWASP Agentic Top 10 (2026)},
-  author       = {{OWASP Foundation}},
-  title        = {{OWASP Top 10} for Agentic Applications for 2026},
-  organization = {OWASP Gen AI Security Project},
-  year         = {2025},
-  month        = dec,
-  day          = {9},
-  url          = {https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/},
-  urldate      = {2026-10-19},
-  note         = {llm}
-}
-
-@misc{owasp2025mcptop10,
-  shorthand    = {OWASP MCP Top 10},
-  author       = {{OWASP Foundation}},
-  title        = {{OWASP MCP Top 10}},
-  titleaddon   = {Beta},
-  annote       = {OWASP project page; living document; items MCP01:2025--MCP10:2025; project lead Vandana Verma Sehgal},
-  year         = {2025},
-  url          = {https://owasp.org/www-project-mcp-top-10/},
-  urldate      = {2026-10-19},
-  note         = {llm}
-}
-
-@misc{mitreatlas,
-  shorthand    = {MITRE ATLAS},
-  author       = {{The MITRE Corporation}},
-  title        = {{MITRE ATLAS}: {Adversarial Threat Landscape for AI Systems}},
-  annote       = {Knowledge base of adversary tactics and techniques against AI systems},
-  url          = {https://atlas.mitre.org/},
-  urldate      = {2026-10-19},
-  note         = {llm}
-}
-
-% ---------------------------------------------------------------- standards
-@misc{oasis2023sarif,
-  shorthand    = {SARIF 2.1.0},
-  author       = {Fanning, Michael C. and Golding, Laurence J.},
-  title        = {{Static Analysis Results Interchange Format} ({SARIF}) Version 2.1.0 Plus Errata 01},
-  titleaddon   = {OASIS Standard incorporating Approved Errata},
-  organization = {OASIS},
-  year         = {2023},
-  month        = aug,
-  day          = {28},
-  url          = {https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/sarif-v2.1.0-errata01-os-complete.html},
-  urldate      = {2026-10-19},
-  note         = {standards}
-}
-
-@misc{eu2022nis2,
-  shorthand    = {NIS2 Directive},
-  author       = {{European Parliament and Council of the European Union}},
-  title        = {Directive ({EU}) 2022/2555 of the {European Parliament} and of the {Council} of 14 {December} 2022 on measures for a high common level of cybersecurity across the {Union}, amending {Regulation (EU) No 910/2014} and {Directive (EU) 2018/1972}, and repealing {Directive (EU) 2016/1148} ({NIS} 2 {Directive})},
-  howpublished = {Official Journal of the European Union, L 333, 27.12.2022, p. 80},
-  year         = {2022},
-  url          = {https://eur-lex.europa.eu/eli/dir/2022/2555/oj},
-  urldate      = {2026-10-19},
-  note         = {standards}
-}
-
-@misc{mitrecwe,
-  shorthand    = {MITRE CWE},
-  author       = {{The MITRE Corporation}},
-  title        = {{CWE}: {Common Weakness Enumeration}},
-  annote       = {Community-developed list of software and hardware weakness types, sponsored by CISA},
-  url          = {https://cwe.mitre.org/},
-  urldate      = {2026-10-19},
-  note         = {standards}
-}
-
-@misc{spdxlicenselist,
-  shorthand    = {SPDX License List},
-  author       = {{SPDX Workgroup, The Linux Foundation}},
-  title        = {{SPDX License List}},
-  annote       = {Standardized short identifiers for open source licenses, used by package manifests and SBOMs},
-  url          = {https://spdx.org/licenses/},
-  urldate      = {2026-10-19},
-  note         = {standards}
-}