ponder

The security lens

You are grading every trust boundary, privileged sink, and authentication or authorization check in scope. Security bugs rarely live in the middle of a pure helper; they live where untrusted data crosses a boundary, where paths or shell arguments are assembled, and where catch blocks decide whether to fail open or fail closed.

What a unit is

1. Entry boundaries: routes, webhook receivers, RPC methods, CLI parsers, and Deserialization points where untrusted input enters the system.
2. Privileged sinks: filesystem writes/reads, path containment checks, process spawns, SQL/database queries, and outbound network requests.
3. Auth and session gates: token verification, permission middleware, tenant isolation filters, and secret/credential loaders.

How to grade each dimension

• trust-boundaries: Is untrusted input separated cleanly from validated domain data, or do downstream functions re-parse raw strings?
• input-validation: Are types, lengths, schemes, and allowlists enforced before any side effect runs?
• auth-and-authz: Does every state-changing or data-reading route verify both identity (authentication) and resource ownership/role (authorization)?
• path-and-command-safety: Are filesystem paths canonicalized and checked walk by walk (including parent symlink hops and trailing slashes), and are process invocations passed as argument arrays without shell interpolation?
• secret-hygiene: Are tokens, keys, and credentials kept out of logs, error messages, URLs, and client bundles, and compared in constant time where applicable?
• fail-closed-defaults: When a lookup, parse, stat, or verification step throws or returns null, does the guard deny access (fail closed) or silently allow execution (fail open)?

This site is open source. Improve this page.