Sourced / Security blog
Review preparation
Website, API and AI security. Clear scope, useful evidence, and practical fixes.
21 articles
- Review preparation
Scope an AI security review around real actions
Map model inputs, retrieved data, tool permissions, approvals, and external effects. Define an AI review that tests boundaries rather than clever prompts.
- Review preparation
Build an API inventory for an authorization review
Inventory API operations, roles, ownership rules, and background effects. Find gaps between your schema and the routes that actually run.
- Review preparation
What a no-findings security report should say
Read a clean security review without treating it as proof of perfect security. Check coverage, blocked tests, versions, and the next review trigger.
- Review preparation
Write rules of engagement that prevent surprises
Turn an approved security review scope into operating rules for timing, rate limits, escalation, evidence, and changes during the test.
- Review preparation
Check authorization before a penetration test
Confirm who can approve a security test, which systems are covered, and when permission ends. Use a practical authorization checklist.
- Review preparation
What evidence belongs in a security finding?
Build findings that engineering can verify and fix. Keep the affected behavior, expected policy, version, impact, and uncertainty connected.
- Review preparation
Retest a security fix without losing the evidence
Verify the repaired behavior on the deployed build, include a legitimate allow case, and record what remains outside the retest.
- Review preparation
Build a test account matrix for a SaaS review
Choose the roles, tenants, and account states needed to test SaaS authorization. Use a matrix with expected permissions and clear reset rules.
- Review preparation
Turn a security finding into acceptance tests
Write regression tests that prove the intended control works. Cover denied access, legitimate use, and side effects without preserving sensitive evidence.
- Review preparation
Prepare a safe source snapshot for security review
Send a versioned, minimized code snapshot for review without secrets, local configuration, or executable setup steps. Keep a clear evidence manifest.
- Review preparation
Separate finding confidence from security severity
Avoid treating a serious hypothesis as a confirmed defect. Record evidence confidence, technical severity, and business priority separately.
- Review preparation
Agree on data handling before a security review
Map what a security reviewer receives, where it goes, who can see it, and when it is removed. Use a practical evidence-handling worksheet.
- Review preparation
Use security evidence in a launch decision
Connect review findings, untested paths, fixes, and rollback plans to a clear launch decision. Use a readiness record without a false secure badge.
- Review preparation
Redact security evidence without losing its meaning
Remove credentials and personal data from a security report while preserving the ownership, sequence, and behavior needed to verify the finding.
- Review preparation
A security review scope your team can actually use
Define the assets, roles, actions, and evidence for a focused application security review. Use a scope worksheet that prevents silent expansion.
- Review preparation
Set stop conditions before security testing starts
Define when a reviewer must pause, who receives the alert, and what evidence is safe to retain. Avoid improvised decisions during a test.
- Review preparation
Keep third-party systems out of accidental test scope
Separate your application from payment, identity, email, and cloud providers. Map which activities you can authorize before a security review.
- Review preparation
Questions to ask before buying a security review
Compare security review proposals by scope, evidence, data handling, remediation, and retest. Avoid buying a report that cannot answer your decision.
- Review preparation
Prepare staging data without copying customers
Build synthetic tenants, records, and integrations for a security review. Preserve the access relationships without exposing production customer data.
- Review preparation
Triage Inbound Vulnerability Reports
Turn an external report into a private, reproducible case with scope, impact, owner, and a clear next response.
- Review preparation
Turn a scanner alert into a defensible finding
Check applicability, reachability, evidence, and impact before treating an automated alert as a confirmed vulnerability in your application.