Secure This Architecture

Start with Internet → API → Backend → Database. Add controls where they enforce a real boundary, then evaluate what still happens if the application or one identity is compromised.

Secure This Architecture
Add controls, then read what is still reachable. There is no score and no “secure” verdict.
Internet
Untrusted
→
plaintext
API
no identity check
→
unvalidated
Backend
static credentials
→
open route
Database
broad role
Click a control to add it to the architecture
Each one changes the threat verdicts below. Read the cost line before you add it.
0 of 16 added
Transport
Identity
Authorization
Input
Abuse
Blast radius
Network
Secrets
Detection
Threats against this architecture12 open · 0 contained · 0 prevented

A legitimate, authenticated user changes a resource id in the URL.

If it works: Cross-tenant disclosure through traffic that looks entirely normal.

Residual: Sharing, delegation and support tooling bypass ownership by design.

Prevented by Resource-scoped authorization · contained by Row-level tenant policy · seen by Audit log or Anomaly alerting

Identified controls
  • • None yet.
Open paths
  • • Credential read in transit
  • • Anonymous caller reaches a privileged operation
  • • Credential stuffing
  • • Customer reads another customer’s record
  • • Input interpreted as SQL
  • • Stolen session replayed
  • • Database reachable beyond the backend
  • • Database credential leaks
  • • Compromised backend exfiltrates data
  • • One request exhausts the database
  • • Unexpected shape reaches business logic
  • • No record of a privileged action
Residual risk
  • Add a control to see what survives it.
Unknowns
  • • Whether each control is actually applied on every endpoint, or only on the ones that were reviewed.
  • • What the admin, support and reporting paths do — they usually bypass ownership checks by design.
  • • Where copies of this data already exist: replicas, backups, exports, search indexes, logs, analytics.
  • • Whether revocation and restore have ever been exercised, rather than merely implemented.
Reading this
Most paths to the database are unobstructed: one application defect reaches the asset directly. Start with the controls that prevent, not the ones that report.

Security Review mode

What are the assets?
Where are trust boundaries?
Which identities exist?
Which components hold secrets?
Which component is overprivileged?
Where could data leak?
How could an attacker persist?
What detects misuse?
How do we recover?