Review application security
Assess one repository, a repository group, or an existing fleet evidence bundle. Ground security claims in an attack path, control, or directly exposed sensitive asset.
Run the lens
- Read the standalone lens protocol completely and prepare the supplied scope with lens ID
application-security.
- Read the application security checks completely. Apply every check family relevant to the application type, exposure, data classification, and observed interfaces.
- Trace untrusted inputs to security-sensitive operations and controls. Classify supported outcomes as strengths or findings; place missing reachability, deployment, or control evidence in unknowns and coverage.
- Follow the protocol to account for every contract-registered check family, validate the result, ingest it, and hand back the canonical artifact path.
For raw collection, deep execution, refreshed advisories, or security scanners, read and follow the safety model. Redact secret evidence before persistence.
Read the review basis when applying OWASP, NIST, CISA, EPSS, or OSV guidance. Read scanner adapters before interpreting tool output.
Boundary
Own application attack paths and defensive controls. Route upstream support age to technology lifecycle and build, provenance, or artifact compromise paths to delivery and supply chain.
Completion
Complete when: every in-scope repository has an exact commit or explicit unavailable state, every applicable check family is accounted for, every claim has bounded sanitized evidence at an appropriate confidence, gaps remain visible in unknowns and coverage, and the shared result validator succeeds.
1---2name: review-application-security3description: Application security review for attack paths and controls around identity, untrusted data, secrets, cryptography, injection, exposure, sensitive data, and exploitable dependencies. Use for secure-code, OWASP, or vulnerability-risk questions.4---56# Review application security78Assess one repository, a repository group, or an existing fleet evidence bundle. Ground security claims in an attack path, control, or directly exposed sensitive asset.910## Run the lens11121. Read the [standalone lens protocol](../audit-software-fleet/references/standalone-lens.md) completely and prepare the supplied scope with lens ID `application-security`.132. Read [the application security checks](references/checks.md) completely. Apply every check family relevant to the application type, exposure, data classification, and observed interfaces.143. Trace untrusted inputs to security-sensitive operations and controls. Classify supported outcomes as strengths or findings; place missing reachability, deployment, or control evidence in unknowns and coverage.154. Follow the protocol to account for every contract-registered check family, validate the result, ingest it, and hand back the canonical artifact path.1617For raw collection, deep execution, refreshed advisories, or security scanners, read and follow the [safety model](../audit-software-fleet/references/safety-model.md). Redact secret evidence before persistence.1819Read the [review basis](../audit-software-fleet/references/research-basis.md) when applying OWASP, NIST, CISA, EPSS, or OSV guidance. Read [scanner adapters](../audit-software-fleet/references/scanner-adapters.md) before interpreting tool output.2021## Boundary2223Own application attack paths and defensive controls. Route upstream support age to technology lifecycle and build, provenance, or artifact compromise paths to delivery and supply chain.2425## Completion2627**Complete when:** every in-scope repository has an exact commit or explicit unavailable state, every applicable check family is accounted for, every claim has bounded sanitized evidence at an appropriate confidence, gaps remain visible in unknowns and coverage, and the shared result validator succeeds.
kenlck