Security Audit Context Building

When to Use

• Starting a security audit of an unfamiliar codebase
• Building a threat model before deep technical review
• Mapping data flows to identify sensitive paths
• Establishing audit scope and priorities
• Documenting architecture for security assessment

When NOT to Use

• You already have full context and are ready to audit
• Quick spot-check of a specific code change (use fix-review)
• Automated scanning (use static analysis tools)

Context Building Phases