Proposed scope
Create a small test API and document its attack surface in an isolated environment. This project is planned and has no completed assessment or findings.
Questions to investigate
Are access checks applied to every object and operation? What inputs cross a trust boundary? How do error responses and resource limits affect exposure?
Evidence to publish
An endpoint inventory, repeatable test requests, risk explanations, remediation changes, and regression-test results alongside the source code.