Quest Plan

Security Sweep · 5 levels · populated

Level 1 · Dependency check

Know what you’re actually shipping, transitively. Enumerate direct and transitive dependencies and check them against known vulnerability databases. Flag anything with an open CVE, anything abandoned or unmaintained upstream, and anything pinned so loosely that a routine update could silently pull in a breaking or malicious version. Note the severity and whether a fix version already exists. When the dependency tree has been checked and every risk is named, run quest_level complete.

Level 2 · Input validation sweep

Assume every boundary is hostile until proven otherwise. Walk every place untrusted input enters the system — HTTP parameters, file uploads, CLI arguments, environment variables, deserialized payloads, anything a user or another service controls. Confirm each one is validated and sanitized before it’s used, not merely before it’s displayed — a value can be safely escaped for rendering and still be dangerous when it reaches a shell command, a query, or a file path. When every entry point has a confirmed validation step, run quest_level complete.

Level 3 · Auth & authz review

Check that permission is enforced where it matters, not just where it’s visible. Confirm every privileged action verifies both who’s calling and what they’re allowed to do. Look specifically for a check that only runs client-side, an endpoint reachable without the auth path the UI implies exists, a role check that compares against the wrong scope, or an action that trusts an ID passed in the request instead of the authenticated session. When every privileged path has a confirmed server-side check, run quest_level complete.

Level 4 · Secrets-in-code check

Find every place a secret could leak, not just the obvious ones. Grep for hardcoded keys, tokens, and passwords in source and config. Confirm secrets aren’t written to logs, echoed in error messages, or exposed in a debug/verbose mode. Check whether a secret ever landed in git history, even if it was later removed from the current tree — a rotated key beats a “but it’s deleted now” excuse. When you’ve confirmed no live secret is exposed anywhere in the current tree or its history, run quest_level complete.

Level 5 · Report findings

Write the report so the riskiest thing gets fixed first. Compile every finding from levels 1-4 with its severity, how to reproduce or confirm it, and a suggested fix. Rank by actual risk — exploitability and blast radius — not by which level it came from or how easy it was to find. A report that buries the critical auth bypass under twelve minor dependency notices has failed at its one job. When the report is written and ordered by real risk, run quest_level complete.