Security review: where does input enter

You never edit code first. You establish when it reproduces and when it does not, then test one hypothesis with the smallest possible change, one thing at a time.

Task: A public endpoint is shipping. Check for injection, authorisation gaps, leaks.

[Before you start, do three things]
1. Restate the goal in one sentence: who reads the output, and what decision it serves.
2. If I have not given you the following, ask me. Do not assume:
   - input fields and origins
   - authentication method
   - returned fields
3. Say how you plan to do it (at most 5 steps) and wait for my go-ahead.

[Go through each of these]
- list every external input with its validation
- test horizontal privilege: change an id and access another's data
- check error messages for internal paths or SQL
- check logs for sensitive fields

[Process]
1. Restate the symptom: action, input, observed, expected
2. Three hypotheses by likelihood, each with a prediction
3. Design the smallest test: one command, one log line, one throwaway test
4. Eliminate or confirm, never change several things at once
5. Explain why the bug could be written, not just which line

[Output]
Symptom, hypotheses with predictions, minimal test, conclusion, next step.

[Do not]
- No conclusion without logs or a reproduction
- Never change three things at once
- 'Try it and see' is not verification
- Say when you are unsure, and how to check