Every tool in the Security Research Collection must satisfy this checklist before being marked complete.
- Functionality complete, no stubs
- Unit + integration tests pass
- Positive, negative, and malformed-input fixtures included
- Security review (Tool Security section) self-checked
- Benchmark recorded in
docs/benchmarks.md - CLI and every exposed interface tested
- Full README, methodology.md, threat-model.md, limitations.md written
- Sample dataset included and referenced in README
- Reproducibility fields present in every finding record
- Evidence/confidence taxonomy correctly applied to every finding
- Originality Gate documented (Differentiation Statement written)
- False-positive behavior evaluated and documented
- Dependencies reviewed (each one justified, none abandoned), SBOM generated
- CI green, repo tagged/topic'd, added to the org profile README index
This template instance (http-request-analyzer) satisfies the structural requirements but uses placeholder methodology content. It is not marked complete as a collection tool — it is a scaffold proof.