Use this as the application-agnostic walkthrough for a codebase.
Produce a living security map that shows what runs, where it runs, why it exists, how it fails, and how to verify it. This is not marketing copy. If a control is missing, say it is missing. If a control is fake, call it fake and explain the fix.
- Surfaces and trust boundaries - Identify main site, admin site, public API, private API, extension clients, webhooks, background workers, and service-to-service calls.
- Boot sequence - List framework initialization, parsers, body limits, proxy trust, sessions, CORS, headers, auth, routes, and error handlers in execution order.
- Middleware order - Document the exact order for validation, exploit screening, sanitization, auth, authorization, rate limiting, CSRF, response shaping, and error handling. Order bugs are security bugs with better camouflage.
- Authentication - Explain session and bearer-token flows, token verification, cookie flags, key rotation, login failure behavior, and recovery paths.
- Authorization - Document object-level checks, tenant scoping, admin checks, role/scope sources of truth, and list/export/bulk behavior.
- Input handling - Cover body, query, params, headers, files, protobuf/gRPC messages, duplicate params, and schema validation.
- Data layer - Map ORM usage, raw SQL exceptions, constraints, migrations, read views, ownership columns, and least-privilege database grants.
- Browser controls - Cover security headers, CSP, CORS, cookies, CSRF, upload downloads, and frontend render assumptions.
- Abuse controls - Cover rate limits, brute force controls, upload caps, scanner middleware, AI-cost protections, and webhook replay protection.
- Logging and incident response - Show security event schema, redaction, correlation ids, SIEM sinks, alertable events, and retention risks.
- Secrets and encryption - Cover key sources, KMS, password hashing, application-layer encryption, token storage, and plaintext leak paths.
- Known gaps - Maintain an honest punch list with severity, affected surface, exploit sketch, recommended fix, and verification plan.
Paste this into an AI when building a master functionality list for a codebase:
Document this codebase in granular detail. Build a master functionality inventory that the AI must check before changing code. For every function, method, class, route handler, middleware, schema, database query wrapper, background job, and exported helper, record:
- File path and symbol name.
- Purpose and security relevance.
- Inputs with exact names, required/optional status, primitive types, and collection shapes such as list, dict/object, tuple, set, array, map, enum, nullable, or union.
- Outputs with exact type and shape, including status codes, thrown errors, response bodies, side effects, and persistence changes.
- Callers and callees, including routes, jobs, tests, imports, database tables, external services, and generated clients.
- Security controls present: validation, normalization, sanitization, parameter binding, authorization, rate limiting, CSRF, CORS, encryption, hashing, logging, redaction, replay protection, and safe error handling.
- Missing controls and specific application-security advice for that symbol.
- Change impact: what breaks if parameters, return type, field names, error behavior, database columns, auth requirements, or side effects change.
Before making any code change, compare the requested change against this inventory. Do not alter public contracts, input/output shapes, route names, database fields, or security assumptions without upstream/downstream impact analysis. Update the inventory after the change.
Generate Mermaid diagrams for the application security map. Include:
1. Request lifecycle from client to route handler to database/external service and back.
2. Authentication and authorization flow for main site, admin site, and API.
3. Data flow for sensitive content from input to validation to storage to logs.
4. Dependency graph for functions and modules touched by the latest change.
Use neutral labels: main site, admin site, API, database, object storage, identity provider, SIEM, queue, worker. Highlight controls such as validation, authn, authz, rate limit, CSRF, CORS, encryption, sanitization, and logging.
The walkthrough is complete only when a new engineer can answer: where does untrusted input enter, where is it validated, where is identity proven, where is authorization enforced, where can data leak, and how do we prove each answer? Anything less is security theater with headings.