Topic 13 · Page 1 of 4 · Map and inspect

Security Review Evidence Packet

This packet documents a bounded student review. It is not penetration testing, a professional audit, or proof that an app is completely secure.

Student nameReview routeArtifact name or class-safe path

Equal-credit routes: no prior packet, public URL, AI account, paid tool, live web, security scanner, real credential, private upload, or external target is required.

1. Four-part trust map

Asset: what must remain correct, private, available, or trustworthy?Entry point: where can input enter?Trust boundary: where do data, identity, or authority enter a different trust level or control domain?Action: what can be rendered, saved, sent, pushed, deployed, deleted, or claimed?

2. Baseline inspection

Path	Evidence location or observation	Status	Concern, next test, or limitation
Input
Output
Browser state
Files + links
Actions + claims

Calibration: “No concern found in this inspection” is not “no vulnerability exists.” Record the path and evidence you actually checked.

Topic 13 · Page 2 of 4 · Predict and test

Two safe test records

Write expected behavior before using a supplied observation or running a class-safe test. Label the evidence route accurately.

EXPECTEDVisible safe behavior before the run.

OBSERVEDExact supplied or directly observed result.

INTERPRETATIONRisk family, path, and reason.

LIMITWhat the case did not test or prove.

Test 1

Safe synthetic input or caseEvidence route

Expected safe behavior, written before observationObserved behavior

ResultRisk family + evidence reason

What this test did not establish

Test 2

Safe synthetic input or caseEvidence route

Expected safe behavior, written before observationObserved behavior

ResultRisk family + evidence reason

What this test did not establish

Use only fictional or approved class-safe inputs. Do not test external systems, classmates, credentials, private records, real health/identity data, exploit payloads, or live accounts.

Topic 13 · Page 3 of 4 · Triage and retest

One finding, one disposition, one owner

Disposition means the recorded next-action decision. Exposure means who or what can be affected; reversibility means how easily the effect can be undone. The course case does not create a universal severity policy.

FindingRisk familyEvidence and locationExposure + reversibility + uncertainty

Disposition

DecisionOwner / reviewer

Why this disposition fits the evidence and authority

Minimum sufficient fix or next action

Causal path to change or containSmallest sufficient change, stop, or questionWhat is intentionally not changingHuman approval required before

Retest and regression

Original failing case + expected resultObserved retest resultOrdinary regression case + expected resultObserved regression result

Retest statusRemaining limitation

Real secret response: stop further disclosure and notify the instructor and account owner; never copy the value here or into AI; urgently revoke or rotate through the provider; then remove current or public exposure and address repository history only through the approved coordinated process; verify invalidation, containment, and possible unauthorized use. Do not attempt unfamiliar account or repository changes alone.

Topic 13 · Page 4 of 4 · Review boundary and defense

Human control and Topic 14 handoff

AI review is optional and advisory. A no-AI review using the same evidence fields earns equal credit.

Bounded review request or no-AI route

Goal and named files/areas or supplied evidenceAllowed scopeProhibited inspection, data, edits, and external actionsQuestion or stop condition when evidence is insufficient

Review rule: an AI suggestion remains unverified until a person checks the relevant file, source, screenshot, test, or rendered result. Do not ask for credentials, private data, full archives, unrelated files, installs, deletion, push, deployment, account connection, or external sending.

No-secrets statement

State what you inspected and how you avoided reproducing sensitive content. Do not paste any secret here.

Assistance disclosure

Tool/person, type of help, and what you accepted, changed, rejected, or personally verified

Topic 14 security defense

Bounded claimVisible evidence to demonstrateKnown limitationNext step or stop condition

Submission if assigned: look for Topic 13 Security Review Evidence Packet in the LMS. Use this packet, a rendered Studio summary, LMS text, DOCX/export, scanned paper, speech-to-text, or another approved equivalent. Do not duplicate the same evidence across routes. The LMS supplies deadline, points, late rules, and resubmission. Core credit depends on equivalent reasoning and evidence, not a public URL, scanner, AI account, code volume, or claim of complete security.

Never submit: real credentials, private records, full chats, private code archives, exploit payloads, account/device screens, restricted files, grades, health or identity data, consent/assent records, unpublished peer work, or unnecessary identity evidence.