Security Surface Audit

Overview

Detect the project's actual threat model first, then audit only the matching attack surfaces against universal bars. A localhost CLI server, a public API, and a published library face different attackers — applying one checklist to all of them produces both noise and blind spots.

Scope is static and defensive: read code, config, and CI definitions. Never develop exploits, run PoCs, or probe live systems unless the human explicitly authorizes it — and say so in the report.

When to use / when NOT

Use when:

• Pre-release or pre-handoff audit of what a project exposes.
• A new surface appeared: embedded server, deploy pipeline, process-spawning command, public package.
• Someone asks "is this exposed / safe / hardened?" about existing code.