The characterization question is the one worth getting right, and it is decided by the contract rather than the caption. Publication 527 sets out both halves. A landlord does not include a security deposit in income on receipt "if you plan to return it to your tenant at the end of the lease," and includes whatever is kept in the year it is kept, because the tenant did not live up to the lease. But where the same money is designated as the final payment of rent, it is advance rent and is income when received. That is a timing consequence for the landlord and a legal one for the tenant, because state deposit statutes are written around the deposit. Whether a state's limits, holding rules, itemization deadlines and penalties reach money the lease describes as prepaid rent is a question about that state's statute, and it is worth reading the clause rather than the heading above it.
In the private rental market there is no general federal rule. Amounts, whether the money must be held separately or bear interest, how quickly it must be returned, what may be withheld and what a landlord owes for getting it wrong are all set by state and sometimes local law, and they differ widely. That single fact answers most deposit questions by telling you where to look rather than what the answer is.
Federally assisted housing is the exception, and the two rules people cite together are opposites. In public housing, 24 CFR 966.4(b)(5) is permissive and capped: at the option of the public housing agency the lease "may provide for security deposits which shall not exceed one month's rent or such reasonable fixed amount as may be required by the PHA." Both limbs matter, and the second is routinely dropped in summaries. The same paragraph allows the deposit to be accumulated gradually rather than paid at once, and provides that, subject to applicable laws, interest earned may be refunded when the tenant vacates or used for tenant services or activities.
In project-based Section 8, 24 CFR 880.608 does the reverse. It is a required amount, not a ceiling: at the initial execution of the lease "the owner will require each family to pay a security deposit in an amount equal to one month's Total Tenant Payment or $50, whichever is greater." The owner must place deposits in a segregated, interest-bearing account, may collect on an installment basis, and must act within "30 days (or shorter time if required by State, or local law) after receiving notification of the family's forwarding address." Two things follow that a tenant can act on. The clock does not start until the owner has the forwarding address, so supplying it is the tenant's first move rather than an afterthought. And the sanction for skipping the itemized list of unpaid rent, damages and estimated repair costs is precise: "If the owner fails to provide the list, the family will be entitled to the refund of the full amount of the security deposit plus accrued interest."
What survives every jurisdiction is that the dispute is evidentiary. The usual fight is not about the law but about whether a given condition is damage or ordinary wear, and about who can show the condition of the unit at two points in time. That is why the itemized statement matters on both sides: it converts a disagreement about a number into a disagreement about specific items, which is a much smaller argument.