Security architecture review

Review in this order

Attention spent in this order finds the most consequential problems first.

1. Authentication. How identity is established, how sessions are represented, how they expire, what happens on password reset and account recovery. Recovery flows are the most commonly weakest path into an account and the least reviewed.

2. Authorization. The one that matters most and gets least attention. For every endpoint and every object: who is allowed, and where is that checked? The characteristic failure is checking on the way in but not on the object itself, so any authenticated user can reach any record by changing an identifier.

Check multi-tenant isolation explicitly and by test, not by reading. Assume every identifier in a request is attacker-controlled, because it is.