[DBIP] Make security `toolType` a normalized multi-value field

[nightmare28899]

Proposal type

Modify column

Affected scope (files/folders/chains)

references/offers/security.csv; inherited toolType values in listings/all-networks/security.csv and listings/specific-networks/*/security.csv; Security wiki column definition

Motivation / problem statement

The current toolType column is documented as a single free-text value, but it is used as a filterable primary category. In the current main snapshot (commit 51cdb41), all 91 security offers have a value and those values split into 19 exact strings.

The same concept is already represented by incompatible values:

• Audits (27 rows) and Audit (4 rows)
• Security (5 rows) and smart contract security (4 rows)
• anti-scam protection (3 rows) and Anti-Phishing, Anti-Scam, Anti-Hacking tool (1 row)
• analysis/testing tools are split among Static analyzer, Symbolic analyzer, Symbolic testing, Fuzzer, and Security testing framework

Fourteen rows use TBD, although the Style Guide reserves TBD for internal transitional schema rollouts. Exact filtering therefore misses equivalent tools, capitalization becomes data, and products with more than one primary security function cannot be represented without overloading tag.

This affects consumers building security-tool comparisons and contributors trying to select an existing value.

Detailed proposal

• Category/table: security
• Column name: toolType
• Change type: modify
• New definition: normalized list of the primary security functions delivered by the offer. Leave blank when no function has been verified; do not use TBD.
• Value type: JSON array of enum values
• Initial allowed values:
  • Audit
  • Penetration testing
  • Scanner
  • Static analysis
  • Dynamic analysis
  • Formal verification
  • Monitoring
  • Threat detection
  • Threat modeling
  • Anti-scam
  • AI security
  • Cryptography
  • Security testing
  • Other
• Examples:
  • slither: ["Static analysis"]
  • medusa: ["Dynamic analysis","Security testing"]
  • forta: ["Monitoring","Threat detection"]
  • certik: ["Audit"]
• Normalization guidance:
  • Use title/sentence case exactly as listed.
  • Use the smallest set that describes the product's primary functions.
  • Keep techniques, ecosystems, and marketing terms in tag; do not duplicate them here.
  • Map Audits and Audit to Audit.
  • Replace TBD with verified values or blank.
  • Add a new enum value only through a documented schema update.

This can be migrated without changing slugs, provider references, or network listings because listing rows inherit the canonical offer value unless they override it.

Contact (optional)

GitHub: @nightmare28899

Rewards address (optional)

No response