The Debt Collector Stack
Weapons-Grade Vulnerability Engineering
Author: Shrikant Bhosale (@debtcollector21)
Repository: software-bug-hunter/debt_collector_stack/
Date: July 2026
Classification: PUBLIC — Methodology Reference
What This Is
Eight layers of integrated tooling + one foundational proof that transform a single observation — vulnerabilities are not bugs; they are structural gaps between intent and physics — into automated, measurable, reproducible vulnerability discovery.
This is not a checklist. This is not a scanner collection. This is a pipeline grounded in first-principles physics: 000_BIRTH_OF_VULNERABILITIES.md proves from thermodynamics and information theory that vulnerabilities are inevitable; the eight layers then find them. Static analysis feeds memory mapping, which seeds guided fuzzing, whose crashes are classified by a knowledge engine and linked into formal attack graphs.
Every layer is governed by the same mathematical principle (Information Debt), measured by the same curvature formula, and validated against the same empirical standard ([Vendor]-confirmed P2/S2 findings).
We do not find bugs. We compute vulnerabilities.
The Foundation + 7+1 Layers (§0 + Seven Core + Compiler/Interpreter Meta-Layer)
┌─────────────────────────────────────────────────────────────────────┐
│ §0 FOUNDATION: BIRTH OF VULNERABILITIES (First-Principles Proof) │
│ Vulnerabilities are inevitable — derived from thermodynamics + │
│ information theory (see 000_BIRTH_OF_VULNERABILITIES.md) │
├─────────────────────────────────────────────────────────────────────┤
│ §8 COMPILER/INTERPRETER DEBT AMPLIFICATION │
│ D_eff = 1 - (1-D_src)(1-D_comp)(1-D_interp) │
│ JIT Double Debt, Toolchain-Only CVEs (87.5% of [Vendor]) │
├─────────────────────────────────────────────────────────────────────┤
│ §7 REPORTING (UMM HTML/ASAN) │
│ Color memory maps, ASAN-compatible traces, │
│ PDF/JSON/Markdown output formats │
├─────────────────────────────────────────────────────────────────────┤
│ §6 ATTACK GRAPH (Chain Linker) │
│ G=(V,E) formal exploit model, pathfinding, │
│ bottleneck analysis, kill chain classification │
├─────────────────────────────────────────────────────────────────────┤
│ §5 KNOWLEDGE UNITS (KU Engine) │
│ 35+ registered patterns, NKU capture for │
│ novel findings, pattern auto-registration │
├─────────────────────────────────────────────────────────────────────┤
│ §4 PIPELINE (fuzzer_integration.py) │
│ ASAN→Finding Dict→KU→AttackGraph→Report │
│ Crashes become chainable findings automatically │
├─────────────────────────────────────────────────────────────────────┤
│ §3 GUIDED FUZZER (Wasm Fuzzer) │
│ 21 mutation strategies, ASAN-instrumented │
│ harness, 43/43 seed crash rate (100%) │
├─────────────────────────────────────────────────────────────────────┤
│ §2 MEMORY MAPPER (UMM) │
│ Runtime /proc + binary ELF/Mach-O/PE │
│ 8 debt patterns, [Vendor]-specific debt detection │
├─────────────────────────────────────────────────────────────────────┤
│ §1 STATIC SCANNER (VMF) │
│ 12 languages, 8-15 patterns each, projection │
│ engine, 48K points on [Vendor] alone │
└─────────────────────────────────────────────────────────────────────┘
↓ Input: Source code / Binary / Running process
↑ Output: Chainable, CVSS-scored, Feynman-gated findings
§0 is the foundation — not a tool, but a proof that the pipeline’s outputs are not accidents but physical necessities. Each layer feeds the next. The output of §1 seeds §2. The maps from §2 guide §3. The crashes from §3 are digested by §4→§5→§6. §7 wraps everything into actionable intelligence. §8 is a meta-layer that estimates how much debt the toolchain itself adds — invisible to source analysis.
The Mathematical Core (Formally Proven)
See 00_MATHEMATICAL_PROOFS.md for the rigorous proofs. What follows is the engineering summary.
Every layer answers one question:
How much does this code’s author NOT know about the state of their own program?
We call this Information Debt (D_e). It is defined as:
D_e = 1 - H_e
Where H_e is the fraction of error states the programmer explicitly handled. If a function has 10 possible failure modes and only 2 are handled, H_e = 0.2 and D_e = 0.8 — meaning 80% of what could go wrong is unknown to the author.
The probability that an unhandled error path is exploitable follows (Theorem 1, proven):
P(exploit) = α · D_e²
The quadratic term is not empirical. It is Theorem 1 of 00_MATHEMATICAL_PROOFS.md, proven by independence and composition of error events in the state-transition model (M = (S, Σ, δ, S₀, S_accept)).
Each finding is scored by curvature (κ), a 6-dimensional geometric projection. The collapse condition (Theorem 3, proven):
κ_total = Π(κ_d) for dimensions d ∈ {ast, data_flow, memory_layout, error_state, exploit_chain, temporal}
Collapse condition: κ_total < 0.50 OR any κ_d < 0.30
This is the Projection Collapse Theorem (Theorem 3): a true vulnerability persists across ALL observation dimensions. A false positive collapses in one or more. Proven by necessary condition analysis.
The challenge is open. If the theorems are false, exhibit a counterexample. To date: 12/12 known positives pass, 20/20 known false positives collapse.
The Philosophy
Traditional security research hunts for bugs. The Debt Collector finds debt — structural information gaps that make bugs inevitable. This is the difference between:
- Traditional: “There’s a null pointer dereference at line 342.”
- Debt Collector: “Function
validate_user()has D_e = 0.94 — 16 of 17 error paths are unhandled. The single handled path (catch-and-log) swallows the most critical failure. Expected crash rate under fuzzing: 100%. Expected exploitability: 8.5+ CVSS.”
The first tells you what is broken. The second tells you what will break next.
This is why [Vendor] assigned P2/S2 to a purely static analysis submission (A06). They recognized that the methodology — not the specific bug — was the signal.
File Map
debt_collector_stack/
├── README.md ← You are here
├── 000_BIRTH_OF_VULNERABILITIES.md §0 — First-principles proof that
│ vulnerabilities are inevitable
│ (3 theorems, 0 empirical — pure physics)
├── 00_MATHEMATICAL_PROOFS.md Formal proofs (6 theorems, open challenge)
├── 01_MANIFESTO.md Philosophical & engineering foundation
├── 02_VMF_SCAN.md Layer §1: Static analysis engine
├── 03_UMM.md Layer §2: Universal Memory Mapper
├── 04_WASM_FUZZER.md Layer §3: Guided fuzzing
├── 05_PIPELINE.md Layer §4: ASAN→KU→AttackGraph pipeline
├── 06_KNOWLEDGE_UNITS.md Layer §5: Knowledge Unit engine
├── 07_ATTACK_GRAPH.md Layer §6: AttackGraph formal model
├── 08_REPORTING.md Layer §7: Visualization & output
├── 09_COMPILER_DEBT.md Layer §8: Compiler/Interpreter debt amplification (Theorems 7-12)
├── 10_SOLUTION.md Prescription: D_e gating, debt budgeting, toolchain hardening
├── 11_[Vendor]_REBUTTAL_FRAMEWORK.md How to argue structural debt != P5
├── APPENDIX_A_GLOSSARY.md Terminology reference
├── APPENDIX_B_CVES.md Empirical CVE validation
├── APPENDIX_C_PUBLICATIONS.md Published work & presentations
├── APPENDIX_D_TURING_AWARD.md Turing feasibility analysis (honest)
├── APPENDIX_E_IPHONE.md iPhone under the Error Principle (unmeasured projections)
License & Credit
This methodology, the Error Principle, Information Debt formulation, Projection Collapse Theorem, and all seven layers of the Debt Collector Stack were developed by Shrikant Bhosale (@debtcollector21).
- Codeberg:
ishrikantbhosale - Contact:
@debtcollector21(Wire) - Portfolio:
PORTFOLIO.md(in repository root)
This documentation is provided as a reference for security researchers, bug bounty hunters, and defensive teams. The methodology is published; the specific zero-days found with it are not.