# Phase 0: Architecture Mental Model + Stack Detection

Before hunting for bugs, detect the tech stack and build an explicit mental model of the codebase. This phase changes HOW you think for the rest of the audit.

**Stack detection:**
```bash
ls package.json tsconfig.json 2>/dev/null && echo "STACK: Node/TypeScript"
ls Gemfile 2>/dev/null && echo "STACK: Ruby"
ls requirements.txt pyproject.toml setup.py 2>/dev/null && echo "STACK: Python"
ls go.mod 2>/dev/null && echo "STACK: Go"
ls Cargo.toml 2>/dev/null && echo "STACK: Rust"
ls pom.xml build.gradle 2>/dev/null && echo "STACK: JVM"
ls composer.json 2>/dev/null && echo "STACK: PHP"
ls *.csproj *.sln 2>/dev/null && echo "STACK: .NET"
```

**Framework detection:**
```bash
grep -q "next" package.json 2>/dev/null && echo "FRAMEWORK: Next.js"
grep -q "express" package.json 2>/dev/null && echo "FRAMEWORK: Express"
grep -q "fastify" package.json 2>/dev/null && echo "FRAMEWORK: Fastify"
grep -q "hono" package.json 2>/dev/null && echo "FRAMEWORK: Hono"
grep -q "django" requirements.txt pyproject.toml 2>/dev/null && echo "FRAMEWORK: Django"
grep -q "fastapi" requirements.txt pyproject.toml 2>/dev/null && echo "FRAMEWORK: FastAPI"
grep -q "flask" requirements.txt pyproject.toml 2>/dev/null && echo "FRAMEWORK: Flask"
grep -q "rails" Gemfile 2>/dev/null && echo "FRAMEWORK: Rails"
grep -q "gin-gonic" go.mod 2>/dev/null && echo "FRAMEWORK: Gin"
grep -q "spring-boot" pom.xml build.gradle 2>/dev/null && echo "FRAMEWORK: Spring Boot"
grep -q "laravel" composer.json 2>/dev/null && echo "FRAMEWORK: Laravel"
```

**Soft gate, not hard gate:** Stack detection determines scan PRIORITY, not scan SCOPE. In subsequent phases, PRIORITIZE scanning for detected languages/frameworks first and most thoroughly. However, do NOT skip undetected languages entirely — after the targeted scan, run a brief catch-all pass with high-signal patterns (SQL injection, command injection, hardcoded secrets, SSRF) across ALL file types. A Python service nested in `ml/` that wasn't detected at root still gets basic coverage.

**Mental model:**
- Read CLAUDE.md, README, key config files
- Map the application architecture: what components exist, how they connect, where trust boundaries are
- Identify the data flow: where does user input enter? Where does it exit? What transformations happen?
- Document invariants and assumptions the code relies on
- Express the mental model as a brief architecture summary before proceeding

This is NOT a checklist — it's a reasoning phase. The output is understanding, not findings.

# Phase 1: Attack Surface Census

Map what an attacker sees — both code surface and infrastructure surface.

**Code surface:** Use the Grep tool to find endpoints, auth boundaries, external integrations, file upload paths, admin routes, webhook handlers, background jobs, and WebSocket channels. Scope file extensions to detected stacks from Phase 0. Count each category.

**Infrastructure surface:**
```bash
ls .github/workflows/*.yml .github/workflows/*.yaml .gitlab-ci.yml 2>/dev/null | wc -l
find . -maxdepth 4 -name "Dockerfile*" -o -name "docker-compose*.yml" 2>/dev/null
find . -maxdepth 4 -name "*.tf" -o -name "*.tfvars" -o -name "kustomization.yaml" 2>/dev/null
ls .env .env.* 2>/dev/null
```

**Output:**
```
ATTACK SURFACE MAP
══════════════════
CODE SURFACE
  Public endpoints:      N (unauthenticated)
  Authenticated:         N (require login)
  Admin-only:            N (require elevated privileges)
  API endpoints:         N (machine-to-machine)
  File upload points:    N
  External integrations: N
  Background jobs:       N (async attack surface)
  WebSocket channels:    N

INFRASTRUCTURE SURFACE
  CI/CD workflows:       N
  Webhook receivers:     N
  Container configs:     N
  IaC configs:           N
  Deploy targets:        N
  Secret management:     [env vars | KMS | vault | unknown]
```
