sc-recon

Codebase architecture mapping detects languages, frameworks, and entry points to establish a security baseline. It identifies HTTP routes, CLI commands, and data-flow pathways, then generates a formal architecture document to drive downstream vulnerability assessment and threat modeling.

A trust boundary in security analysis is a point where data enters or moves between system components with different privilege levels. Mapping these boundaries identifies where data sources, processing steps, and security controls interact to prevent unauthorized access.

Identifying entry points and data-flow pathways involves scanning the codebase to map HTTP routes, CLI commands, message queues, and scheduled tasks. This process traces data from external sources through processing steps to establish a formal security architecture document.

Yes, architecture mapping supports multi-repo security projects by detecting the technology stack and mapping entry points across repositories. It establishes a consistent baseline for vulnerability detection and targeted remediation workflows across all project components.

The best way to generate an architecture document for threat modeling is running a reconnaissance skill that detects the tech stack, maps entry points, and models data-flow pathways. This outputs a formal Markdown file detailing trust boundaries for downstream security skills.

Yes, you need a codebase architecture report before running vulnerability assessment because it provides the formal technology stack, entry point, and trust boundary mapping required to guide targeted security analysis and downstream remediation workflows effectively.