Verification · Threat modeling · Attack surface inventory
Network entry points
HTTP, gRPC, WebSocket, raw socket and webhook receivers.
How to build it
- List the HTTP, gRPC, WebSocket and webhook routes from the route tables or API spec.
- Record each entry point as an element with its trust boundary in the threat model.
- Review the list when routes are added or their authentication changes.
Signals in a repository
- An OpenAPI or route file that the threat model mirrors.
- A threagile.yaml or pytm model with an entry for each public endpoint.
In practice
No scanned repository runs a tool for this check. The steps above are the only guidance.