To produce the PDF: press Ctrl+P (Windows/Linux) or Cmd+P (Mac) → Destination Save as PDF → Margins Default → tick Background graphics. For page numbers, tick Headers and footers. No software to install.

Blast Radius Assessment

{{TARGET_NAME}}
Where authority is concentrated into a single point — mapped across Identity, Governance, and Access

{{CLASSIFICATION}}
Target
{{TARGET_DESCRIPTION}}
Scope
{{SCOPE}}
Review date
{{DATE}}
Prepared by
{{AUTHOR}}
Evidence basis
Static inspection{{RUNTIME_NOTE}}

1. Executive summary

This is an Blast Radius Assessment, not a security risk assessment. It maps where authority is concentrated into a single artifact or party — such that whoever obtains that one thing obtains everything it governs — across three cores: Identity, Governance, Access. OWASP/CWE tags are supporting detail, not the frame.

{{ONE_LINE_VERDICT}}

{{EXEC_PARA_1}}

{{EXEC_PARA_2}}

Headline numbers

Findings raised{{N_FINDINGS}} ({{N_CRIT}} critical, {{N_HIGH}} high, {{N_MED}} medium, {{N_LOW}} low)
Architectural liabilities (the artifact is the exposure){{N_ARCH}}
Fixable in application / ops / config{{N_APP}}

What a reader should take away

Contents

  1. Executive summary
  2. Attacker model
  3. Coverage — verdict per surface
  4. Findings
  5. Breach blast radius
  6. Appendix — severity table, precedents, verification

2. Attacker model

The attacker is not a particular profile — it is anyone. Most findings below can be exploited by anyone who can clone the repository, replay a stolen token, or point now-commonplace AI tooling at the code: no privileged position, no insider access, and no special skill is needed for the worst of them. The range runs from a random opportunist at the low end up to a privileged insider at the high end — but the exposure that matters is at the low end, and that is where this review holds the bar. A control that assumes either “this component is not compromised” or “nobody will find this” fails the design test.

Assumed adversary capabilities — from the lowest realistic bar upward
CapabilityMeaning
Low-skill / AI-assisted opportunistNo privileged position and little expertise. Uses off-the-shelf and AI tooling to scan a leaked or cloned repository, replay a stolen token, or hit an open endpoint. Enough, on its own, to exploit findings such as committed secrets, default/shipped accounts, and open endpoints.
Supply-chain maintainer / repo readerRogue developer, compromised vendor, or anyone with read access to the source repository — a direct path to production when secrets are committed.
Root access holderTotal control of one or more components — server, database, network segment, or codebase.
Collusion-capable & persistentCoordinates multiple compromised components; observes traffic, dumps memory, and runs campaigns over months.

Findings reachable at the lowest bar — a cloned repo, one leaked credential, one stolen token — are marked as such, because those need no foothold and no skill to hit today. Checking that controls also survive a privileged insider is added rigour, not the primary threat: the primary threat is that these are reachable by anyone.

3. Single-point map (coverage)

Every surface below was examined. A recorded verdict is given for each, including where nothing was found — a review that omits a surface silently is indistinguishable from one that found it clean.

#SurfaceVerdictEvidence
1Credential verification{{V1}}{{E1}}
2Token signing and verification{{V2}}{{E2}}
3Session and token binding (DPoP){{V3}}{{E3}}
4Authorization placement and role source{{V4}}{{E4}}
5Data at rest{{V5}}{{E5}}
6Privileged operations and fan-out{{V6}}{{E6}}
7Machine identity and secrets{{V7}}{{E7}}
8Recovery path and client integrity{{V8}}{{E8}}

Verdict is one of Concentrated (authority is concentrated to a single point here), Sound (genuinely distributed or absent), N/A or Not checked. A Sound verdict carries evidence of the control that was found, not merely the absence of a problem.

4. Single points of compromise

Grouped by core — Governance, Identity, Access — worst gap first within each; adjacent config weaknesses that are not central points are listed separately.

Findings are ordered worst-first. Each is tagged with its OWASP Top 10:2025 category and primary CWE in its Standards & mappings row; the appendix severity table (§7.1) groups them by category. Each also names its single point of failure — the one artifact or party whose compromise defeats the control — and carries a documented precedent for the failure class, cited for its mechanism, never as a forecast of this organisation’s losses. Evidence is tagged Verified (observed in source) or Inferred (implied, not confirmed).

Access tokens are unbound bearer tokens — proof-of-possession is not enabled

High
F-01 · SG-03 · I-12 · T-05
Overview
Single point of failure: the access token. Possession is sufficient — any place the token passes through (browser memory, an XSS payload, a proxy or log, an uploaded support file) is a full-session takeover until it expires, replayable from any machine. Verified
Description
What the control is, why it is absent here, and what the attacker gains. State the mechanism in plain language a director can follow. State that an architectural artifact cannot be patched away — the liability exists as long as it does.
Proof of concept
Static-analysis evidence — no live exploit was run. Re-runnable from the repository root.
src/api/client.ts:17 config.headers.Authorization = `Bearer ${token}`; // no proof-of-possession header $ grep -rni "dpop|cnf|jkt" src/ # → no matches (server never checks)
Business impact
For an architectural / concentrated-trust finding, frame it as an inherent liability + historical breach + average cost — no vendor named. Example: Because the token is an unbound bearer credential, the application is inherently exposed to replay — this is not a bug to patch; the liability exists as long as possession alone grants access. It has played out in history (BP-KEY-05, CircleCI — a stolen token replayed remotely, every customer forced to rotate every secret). Breaches of this class cost, on average, USD $4.44M (IBM Cost of a Data Breach 2025). Put the average cost on EVERY finding (pick the sector figure); cite the breach for the mechanism, never its one-off total for the cost. For a coding/config finding, give the impact, a relatable breach if one fits, the average cost, and the real fix. Do not mention Tide/TideCloak in this report — that is the phase-2 companion.
Standards & mappings
OWASP A07 Authentication Failures CWE-294 Authentication Bypass by Capture-replay RFC 9449 BP-KEY-05

5. Breach blast radius

What a full compromise of the application environment yields today, versus after remediation.

Exposed today

    {{EXPOSED_LIST}}

6. Appendix

6.1 Severity summary — grouped by OWASP Top 10:2025

{{SEVERITY_ROWS}}
IDFindingCWESeverityPrecedent

Findings grouped by OWASP Top 10:2025 category, worst category first. Severity is rated against the current build. CWE follows the list published for each OWASP category. The precedent column is what makes each row checkable rather than asserted; internal SG-xx/BP-xx identifiers are cross-references to the review methodology.

6.2 Precedents cited

{{PRECEDENT_ROWS}}
IDIncidentConfidenceSource

Confidence reflects source quality: High — multiple primary sources (regulator filings, SEC 8-K, government reports). Medium — secondary reporting. Low — contested or attacker-claimed figures, flagged in text wherever used.

6.3 Verification commands

Commands used to establish the findings above, for independent re-execution.

{{VERIFICATION_COMMANDS}}