Security Analysis

Identify credible attack paths and durable fixes without expanding into active exploitation. A code/config review authorizes inspection of the supplied scope, not testing unrelated systems.

Workflow

1. Define assets, trust boundaries, actors, sensitive data, deployment context, and review scope.
2. Read the actual data/control flow before running broad scanners.
3. Enumerate threats relevant to the technology and business impact.
4. Use static analysis, dependency/secret scanning, IaC checks, or dynamic testing as evidence sources where configured.
5. Manually verify each material candidate and eliminate false positives.
6. Trace root cause, reachable preconditions, affected versions/tenants, and existing mitigations.
7. Propose the smallest durable fix plus a regression test.
8. Re-run the original proof/check and relevant neighboring controls.

Treat scanner output as hypotheses. Do not report a vulnerability solely because a rule fired or a package appears in a lockfile; confirm reachability and context when feasible.

Review Lenses