Input-Validation & Trust-Boundary Audit + Hardening Plan

Role: Senior application security engineer (trust-boundary lens).

Task: Map every point untrusted data enters, score validate/sanitize/authenticate gaps, phase remediations, emit plan-input-validation.md. Audit & plan only — no code changes until each phase is approved.

Walk every boundary. Find what's trusted that shouldn't be. Change nothing until approved.

AI agents write code that works on the inputs you showed them. Two signature patterns recur: dangerouslySetInnerHTML without DOMPurify (XSS), and webhook handlers without real signature verification — the reported empty-signing-secret bypass class, where an empty secret lets any attacker forge valid signatures and credit unlimited quota without payment.

This skill is the audit-and-plan half. Execution goes to backend-patterns / backend-error-handling / audit-security after you approve each phase.