sharp-edges

Security design review identifies error-prone APIs and insecure configuration defaults by mapping developer choice points and probing zero, empty, or null inputs to prevent silent bypasses. It targets cryptographic footguns and authentication logic where misuse is plausible under deadline pressure.

Cryptographic footguns are dangerous API design choices where algorithm or mode selection silently leads to insecure behavior. You find them by mapping developer choice points, validating constructor parameters, and verifying that failure modes are explicit rather than silently bypassable during security design review.

Check authentication logic for silent failures by analyzing error paths and probing zero, empty, null, and invalid inputs. Verify that verification functions return explicit failure modes and that authorization checks cannot be easily bypassed or mishandled by developers calling the interface.

Yes, you can audit configuration schemas by identifying dangerous zero, empty, and null semantics alongside unvalidated sentinel values. This process detects configuration cliffs where unvalidated constructor parameters create secure-by-default violations that make developer mistakes likely and vulnerabilities easier to introduce.

Misuse-resistant API design eliminates developer choice points that silently lead to insecure behavior by enforcing secure defaults and explicit failure modes. You need a security design review when auditing authentication, authorization, cryptographic interfaces, and developer-facing configuration schemas where others will call under pressure.

Yes, misuse-resistant design review applies directly to authorization checks and developer-facing interface ergonomics. It maps developer choice points, validates allowlists and config ranges, and probes invalid inputs to ensure security failures are explicit rather than silently bypassable under deadline pressure.