What gets inspected
Identity and data boundaries
Authentication flows, authorization checks, row-level isolation, exposed secrets, and paths where one user may reach another user’s data.
External events
Webhook signatures, idempotency, retries, duplicate handling, partial failure, and whether a provider outage creates corrupt state.
Failure behavior
Swallowed errors, missing logs, unsafe fallbacks, concurrent requests, destructive actions, and whether production incidents can be reconstructed.
Deployment and recovery
Migrations, environment configuration, rollback path, monitoring, and the exact checks required before a release is accepted.
AI behavior
Prompt and tool boundaries, evaluation cases, model fallback, cost exposure, and when human approval is required.
The deliverable
A written diagnostic separates observed findings from hypotheses. Each finding includes severity, evidence, likely impact, a minimal remediation, and a verification step. Implementation is scoped only after the diagnostic.
Truth boundary
This is not a penetration test, legal compliance opinion, SOC 2 certification, or a claim that every defect can be found in a short audit. Those limits are stated before work begins.