Audit Security

Find where untrusted data crosses a trust boundary without the right check, and close the gap without breaking the feature. Approach the code as a bug hunter: assume every input is hostile until a server-side check proves otherwise.

Examples lean on a web stack (HTTP, a browser, an ORM, JWT) because that is where these bugs cluster, but the boundaries apply to any stack — swap the mechanism for whatever yours uses.

Glossary

• Trust boundary — the line untrusted data crosses on its way into a sensitive operation: network → app, input → interpreter, app → browser, one principal → another's resource. Every vulnerability here is data crossing one of these without the check that boundary demands.
• Fail closed — on any error, ambiguity, or missing check, deny. A thrown exception must not land the user inside the protected action.
• Least privilege — every principal, token, and database role gets the minimum scope the task needs, nothing held "just in case".
• Server-side truth — every security decision is re-made on the server. Client-side checks are UX, never enforcement; a control the user cannot see is still reachable by a crafted request.
• Defense in depth — no single control is the only thing standing between an attacker and the asset.

Axes

A security audit walks six trust boundaries. Each has a detail file with the smells, heuristics, and fixes for that boundary. Read the relevant file before classifying a finding — the heuristic is the citation, not a hunch.