Create & Launch an App Guide

Act as a principal security architect. Inspect this codebase/project documentation to locate all architecture definitions, API routes, data flow models, and entry points. Map out all trust boundaries automatically, and perform a full STRIDE analysis (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) on every component crossing those boundaries. Flag any blind spots or unvalidated entry points you discover. Scan the project files to identify all external dependencies, third-party APIs, SDKs, webhook listeners, and background workers. Map where external data enters the ecosystem and where egress calls leave. Identify where input validation, payload sanitization, timeout controls, or perimeter protections are missing.

Search the codebase to discover the authentication and session management implementation (such as JWT handling, OAuth/OIDC flows, session cookies, or API keys). Analyze the full token lifecycle from issuance to validation and revocation. Identify potential security flaws in signing key management, token expiration/rotation, cross-origin/CORS handling, and session invalidation. Locate the access control enforcement points, role/permission schemas (RBAC/ABAC), and database models in this project. Inspect how object ownership and tenant isolation are verified across API endpoints. Identify any logic paths, missing middleware, or database queries vulnerable to Broken Object Level Authorization (BOLA/IDOR) or cross-tenant data leaks.

Find and analyze all cloud architecture definitions, network configurations, Dockerfiles, compose files, and deployment manifests (e.g., Terraform, CloudFormation, Kubernetes, Helm) across the project. Map out the network topology, ingress/egress rules, and service communication paths. Evaluate them against Zero Trust principles and identify opportunities for unauthorized lateral movement. Audit all Infrastructure as Code (IaC) and container configuration files in this repository. Identify security misconfigurations, overly permissive IAM roles, exposed ports, missing encryption-at-rest or in-transit policies, root container execution, and deviations from CIS Benchmarks.

Inspect the codebase and schemas to locate how sensitive data (such as PII, payment info, credentials, and tokens) is handled, stored, and transported. Evaluate the encryption mechanisms, hashing algorithms, and key management implementations found. Check for places where sensitive data might leak via application logs, error traces, HTTP headers, or caching layers. Locate all CI/CD pipelines, build scripts, environment templates, and configuration loaders. Analyze how secrets and credentials are injected, scoped, and utilized during build and runtime. Identify hardcoded secrets, overly broad build-time permissions, unpinned action dependencies, or insecure secret-passing practices.

Locate the API gateway configs, routing middleware, and resource-heavy endpoints (such as file uploads, complex search queries, data exports, or regex parsing). Evaluate the existing rate limiting, payload size limits, request timeouts, and resource throttling. Identify design gaps that leave the service open to Layer 7 Denial of Service (DoS) or resource exhaustion. Analyze the database connections, caching layers, queue workers, and data persistence setup found in this repository. Identify single points of failure (SPOFs), missing retry/circuit-breaker logic, and risks related to connection pool exhaustion or unhandled failovers under heavy production load.

Search the project to evaluate the logging, telemetry, and audit trailing implementation. Verify whether critical security events (login attempts, permission changes, administrative overrides, data exports) generate structured, auditable logs. Check whether logs expose sensitive customer data or lack integrity controls that would allow an attacker to suppress or alter audit trails.