palarran-security-ingress

原文涵盖的主题

• Ingress security audit

Read the profile guide, dated primary sources, shared audit/evidence contract, domain contracts, decision memory and global memory. Identify the actual target, root/package AGENTS, project locale, private INDEX and applicable accepted decisions; library and target are different roots. Use /palarran:security:ingress {scope?}. Resolve an omitted scope from actual project context, then state finite surfaces and gaps. --plan permits local inspection and inert private coverage/test planning only: no application/scanner execution, remote/search-provider calls, fixes, installs or probes. Default audit is scoped readonly source/configuration review plus public-source research. Reuse concrete existing test/remote permissions when present; do not infer them from a proposed test. 1. Bind exact revision/dirty snapshot, framework/runtime and known deployment configuration. Build the guide's route/entry-point ledger covering forms, controllers/actions/APIs, RPC/WebSockets, uploads/imports, webhooks, headers/cookies and non-browser producers. Trace input→parser/schema→principal→object/property/function authorization→sink→response, including alternate/direct-backend paths. Unknown inventory is a g

这里只展示节选，请以完整原文和当前要求为准。