A vulnerability is a hidden weakness in software or its design that can expose systems to threats. Modern architectures, interconnected services, third-party APIs, and cloud infrastructure can multiply these weak points, making security a development concern rather than a final check. section 8.1.1 section 8.2.2
Use vulnerability analysis as a guided, reviewable workflow:
- Describe a system or hypothetical scenario, then ask which threats and vulnerabilities may arise. section 8.1.2
- Refine the questions around particular attack vectors, assess risk, and prioritize what deserves attention first. section 8.1.2
- Request countermeasures and implementation guidance, then verify recommendations against current authoritative security resources. section 8.1.2
- Combine automated analysis with skilled human review; generated findings are useful prompts, not proof that a system is secure. section 8.2.2 section 8.5
Design review findings
A review of an application design can expose plaintext password storage and incomplete role-based access control. The next step is to ask for safer implementation guidance, then test whether permissions are actually enforced. section 8.2.2
