audit-context-building

To build a mental model for codebase security auditing, perform bottom-up orientation and micro-analyze every non-trivial function with line precision before hunting vulnerabilities, ensuring full end-to-end understanding of trust boundaries and dataflow.

Context building in threat modeling is the process of mapping invariants, assumptions, and adversarial external interactions before bug discovery. It requires evidence-first discipline to prevent hallucinations and keep assumptions continuously updated against codebase evidence.

To track trust boundaries and invariants across external calls, treat internal calls as internal execution and external calls as adversarial unless code is available, propagating execution context continuously across function boundaries.

Security audits miss cross-function dataflow vulnerabilities when they skip ultra-granular micro-analysis. You must perform line-by-line reasoning and maintain explicit invariants to understand complex end-to-end workflows before attempting discovery.

Yes, YAML frontmatter-driven activation is required to enforce strict structured output formatting, ensuring that invariants, assumptions, and risk coverage are explicitly documented during the context building process.

Adversarial reasoning in code analysis should be applied when evaluating external interactions where source code is unavailable, treating these external calls as untrusted to accurately map system trust boundaries and execution context.