Threat Check

Define the actors and what they can reach

List the entry points, the assets worth protecting, and every actor with a different level of access, including untrusted documents, extensions, and outside services that can influence the change. Trace what is actually enforced in the code, not what the design doc claims should happen, and keep every test inside the scope the person actually authorized.

Turn the change into abuse cases

Follow input from where it enters to where it gets interpreted, and ask concrete questions along that path.

• Can a caller forge an identity, swap a resource ID, or reuse a revoked grant
• Can untrusted input become code, a database query, or an instruction aimed at a Familiar
• Can an allowed URL or upload reach a more privileged destination
• Where do secrets end up — logs, error messages, generated files, backups
• Can a retry, a race, or a repeated request cause an effect that should only happen once

Give agents authority without a blank check

Separate what the person actually asked for from instructions buried inside a page, file, or tool result — that content can inform a Familiar, but it cannot grant itself new access. Enforce identity checks in real code, not through a model's promise, and preserve the person's original scope across every retry and delegation. Signing in grants access; it is not an open mandate to do anything the account technically could.

Verify the fix and the legitimate path together

Build the smallest safe reproduction of the issue, then pair it with the same operation carried out legitimately, to prove the fix closes the hole without breaking the feature. Fix problems at the actual authority boundary, not with a second, overlapping policy engine or a blanket approval prompt that just hides the defect behind friction.

Report findings honestly

State severity based on real impact and real prerequisites, keep confirmed failures clearly separate from plausible-but-unproven risks, and never claim a clean bill of security. A review with no findings only means nothing turned up within its own stated scope and methods.