Security analysis

A finding is only real if you can describe the attacker, what they control, and what they get. "This could be unsafe" is not a finding — it is an unfinished one. The discipline here is identical to debugging: trace from a source you can influence to a sink that does something dangerous, and prove the path is unbroken.

Scope: this is for reviewing code you or the user are authorized to work on — your own projects, your employer's, or an engagement you have permission for. It finds and fixes defects. It does not produce working exploits against systems you do not control.

1. Map trust boundaries first

You cannot assess code without knowing where untrusted data enters. Identify: