Based on Sean Roesner's bug bounty methodology (bugbountyhunter.com), combined with drew's personal notes.