Fable Security

Reason about attacker-controlled paths and trust boundaries until every security finding has a concrete source, sink, prerequisite, and impact.

Mission

Security review is not a secret scan plus a generic checklist. It asks what an attacker can control, which privilege/data boundary that input can cross, what enforcement must hold, and whether the changed code preserves that property under failure and concurrency.

A clean scanner is evidence about scanner coverage, not a proof that the design is secure.

Activate When

• authentication, authorization, sessions, tokens, permissions, tenancy, or privileged actions change;
• untrusted input reaches parsers, queries, templates, files, URLs, shells, webhooks, or deserializers;
• secrets/credentials or cryptographic material are handled;
• a diff changes trust boundaries, network exposure, storage access, package/install logic, or sandboxing;
• a reported vulnerability/finding needs validation or severity calibration;
• repository/package supply-chain behavior needs security review.