Attack surface inventory

Lists every entry point and trust boundary: API endpoints, webhooks, queues, schedulers, parsers, CLIs, third-party scripts, model calls.

V1059 technique

not detectable from CI configuration

Sub-techniques

ID	Name	Description
`V1059.001`	Network entry points	HTTP, gRPC, WebSocket, raw socket and webhook receivers.
`V1059.002`	Asynchronous entry points	Queue consumers and scheduled jobs that act on external data.
`V1059.003`	Data parsers and deserialization	File, archive and object parsers that take untrusted input.
`V1059.004`	Infrastructure and configuration	Infrastructure as code, secrets management, caching and edge routing.
`V1059.005`	AI and model interactions	Prompts, tools and retrieved content that cross a trust boundary.

Enumerate entry points from route tables, consumers and schedulers in code.
Describe the system as a model (pytm, Threagile) with data flows and trust boundaries.
Regenerate the model when entry points change.

Signs that a codebase already runs this technique, and where to read how it is configured.