Backend Security Review

Inspect the actual stack and trust boundaries before judging security. Map entry points, authentication, authorization, sensitive data, databases, uploads, payments, third-party integrations, background jobs, administrative paths, and deployment configuration. Treat client-controlled values and public endpoints as hostile.

Workflow

1. Identify assets, actors, entry points, trust boundaries, and privilege transitions.
2. Trace sensitive operations from request or event source through validation, authorization, business logic, data access, and response or side effect.
3. Check secrets, authentication, token or session lifecycle, object-level and function-level authorization, validation, injection, error handling, logging, rate limiting, uploads, webhooks, payments, jobs, CORS, headers, and response filtering.
4. Validate candidate findings against reachable code and existing controls. Do not report theoretical issues as confirmed vulnerabilities.
5. Rank findings by exploitability and impact. Include the affected path, attack scenario, evidence, and smallest safe remediation.
6. Implement fixes only when the user asks for changes, then run focused tests and relevant project checks.

Guardrails