Use one copy per question. Keep private captures and credentials outside the public repository and any automatically shared folder.
Question and scope
- Date and operator:
- Question to answer:
- Owned target or authorizing owner:
- Permitted devices, methods, time, and changes:
- Other people/devices that could be affected:
- Stop condition and recovery plan:
- Hardware or paper exercise:
Reproducible setup
- Flipper model, firmware source/version, region:
- Application version:
- External module and its firmware, if any:
- Target manufacturer/model and relevant software version:
- Interface and protocol:
- Relevant settings and wiring, excluding secrets:
- Primary documentation and date accessed:
Observation
| Step | Expected result | Actual result | Evidence reference |
|---|---|---|---|
| Baseline | |||
| Test | |||
| Comparison | |||
| Restore |
- Operation actually established: detection / reading / saving / emulation / replay / authentication / other
- What the result supports:
- What it does not establish:
- Plausible alternative explanations:
- Missing visibility or incomplete data:
- Misuse mechanism and the condition that would enable it:
- Defense tied to that condition:
Evidence and cleanup
- Evidence class: manufacturer documentation / original research / reported incident / policy statement / THL hardware observation / synthetic illustration
- Private originals stored at: use a private reference, not credentials in this sheet
- Public copy reviewed for identifiers and secrets:
- Registrations, pairings, test files, and settings cleaned up:
- Retention/deletion arrangement:
- Hardware validation: not run / inconclusive / observed as described, with evidence
An expected result belongs in the expected column. A source review or paper exercise must not be relabeled as a THL hardware measurement.