Appendix D. Reference documents

These are the official documents cited in this book. Unless otherwise marked, they were checked on October 20, 2026; marked documents were checked on October 21, 2026.

OWASP

• Top 10 for LLM Applications 2025
• Top 10 for LLM Applications 2026 and official 2026 list — checked October 21
• 2025 item pages: LLM01:2025 · LLM02:2025 · LLM03:2025 · LLM04:2025 · LLM05:2025 · LLM06:2025 · LLM07:2025 · LLM08:2025 · LLM09:2025 · LLM10:2025
• Top 10 for Agentic Applications for 2026
• Threat Modeling Cheat Sheet
• LLM Prompt Injection Prevention Cheat Sheet
• AI Agent Security Cheat Sheet
• Authorization Cheat Sheet
• Cross Site Scripting Prevention Cheat Sheet
• Logging Cheat Sheet
• Secrets Management Cheat Sheet
• CSV Injection
• CycloneDX ML-BOM

Anthropic

• Mitigate jailbreaks and prompt injections
• Define success criteria and build evaluations
• Computer use tool
• Model IDs and versioning
• Model deprecations
• Messages API — temperature — checked October 21

OpenAI

• Safety best practices
• Data controls (Your data)
• Agents SDK — Guardrails
• OpenAI Harmony format — checked October 21

Google

• Secure AI Framework (SAIF)
• SAIF risk map

Microsoft

• Threat Modeling Tool — Threats (STRIDE)
• Prompt Shields in Azure AI Content Safety

NIST

• AI Risk Management Framework
• AI RMF Core
• NIST AI 600-1 Generative AI Profile
• SP 800-61 Rev. 3 Incident Response Recommendations

Model Context Protocol

• Specification — Tools (2026-07-28)
• Security Best Practices (2026-07-28)

MITRE

• MITRE ATLAS
• ATLAS data repository

Hugging Face

• Pickle Scanning
• Safetensors

National Law Information Center · Personal Information Protection Commission

• Personal Information Protection Act — Articles 23, 28-8, 29 and 34 (effective September 11, 2026)
• Enforcement Decree of the Personal Information Protection Act — Articles 39, 39-2, 39-3 and 40 (effective September 11, 2026)
• Standards for Measures to Ensure the Security of Personal Information — Personal Information Protection Commission notice, Articles 8 and 12 (effective July 1, 2026)