[cvas22]

Summary :

Closes #107

Adds a page on the OWASP Automated Threats to Web Applications project to the threat modeling section of Design, following the project page structure in the contributing guide. It explains what automated threats are and how they differ from vulnerabilities, lists the 21 OAT threat events, and shows how to use them during threat modeling and when writing requirements, with a pointer to the Bot Management and Anti-Automation Cheat Sheet for countermeasures. The page is added to the site and English PDF navigation.

Description for the changelog :

Add a page on the OWASP Automated Threats to Web Applications project

Declaration:

Thanks for submitting a pull request, please make sure:

• content meets the license for this project
• you have read the contribution guide
  and agree to the Code of Conduct
• either no AI-generated content has been used in this pull request
• or any use of AI
  in this pull request has been disclosed below:

This PR was done with the help of Claude with Opus 5.5. Output was human edited, reviewed, and deemed fit to finalize PR.

Other info :

The OAT list and names are taken from the project's repository, where OAT-003 now appears as Cost-Inflation Fraud alongside the older Ad Fraud page, so the page mentions both. Could I be assigned to #107?

[jgadsden]

Hello @cvas22 , could you be sure to read the contribution guide and the Code of Conduct, in particular the use of generative AI

There is some material here that is useful, but it looks very much as though generative AI has been used to create the changes and to write the pull request, and so needs to be revised

[cvas22]

@jgadsden Yes, I read it. Please give me some time to complete the PR (it's draft now). AFAIK, we're allowed to use it.

although the use of generative AI is not prohibited, it must be declared in the pull request

[cvas22]

@jgadsden Updated PR in accordance with the guidelines under contributing. All content was human reviewed, human edited, and human checked to ensure it does what it claims it does in an efficient manner. Please leave a message if you'd like anything else from me. I checked that:

• OAT list: all 21 IDs and names match the project's list.
• OAT-003: the project's own page says it was called Ad Fraud before v1.3, so "previously Ad Fraud" is right.
• Project status: it's listed as a Lab project, as the page says.
• Examples: the sneaker bot name comes from the Scalping page's "Other Names" list. The Carding/Card Cracking requirement example comes almost word for word from the project's own use-cases page.
• Links: all six resolve to the right pages.
• Format: the page follows the same layout as the other threat modeling pages, and the nav entries are in both mkdocs files.

[jgadsden]

Hello @cvas22 , I understand the use of AI is quick and seems to fulfil what is needed, but ultimately it does not deliver true insight into what the OATS project actually is, why a developer would want to use it and how it needs to be used - it can only provide superficial answer s
What is needed is true knowledge about the project, OATS in this case, and human insight that provides a developer with reasons and knowledge that go beyond what can be gleaned by AI
I guess it is the difference between a Lonely Planet Guide and Google Maps, one has human insight and the other is truthful but mechanical
If you are willing to use OATS in practice and then provide insight from your experiences then we can keep this pull request open?

[cvas22]

@jgadsden Some background: I've been a dev for over decade and deal with web-app security on a daily basis. All of the commit data has insights gained from my personal knowledge through the years too. And yes, we use OATS in practice (and hence the reason for the contributions/PR).

[jgadsden]

@jgadsden Some background: I've been a dev for over decade and deal with web-app security on a daily basis. All of the commit data has insights gained from my personal knowledge through the years too. And yes, we use OATS in practice (and hence the reason for the contributions/PR).

OK, that makes perfect sense, thanks @cvas22
Pipeline / workflow tripped up over CAPTCHA and Footprinting, if these could be added to the word list then we are all set to merge