Security Audits Follow the Data Path

A route can look authenticated while a neighboring log, health endpoint, static mount, or frontend bundle leaks the same asset. Security review therefore needs a path-based view across UI, API, filesystem, database, and provider boundaries.

For each sensitive value, record its source, permitted destinations, redaction rule, and revocation path. Test the boundary from the perspective of an untrusted LAN process, browser extension, log reader, or compromised peer.

The practical output is not a score alone. It is a small set of verified statements such as ‘unauthenticated reads fail’ and ‘a known canary token never appears in logs.’