-
Notifications
You must be signed in to change notification settings - Fork 3
Vulnerability Coverage Map
16 Eyes doesn't run a static list of N checks against every repo. /16-eyes init first
profiles the repo (stack, domain, architecture, the specific subsystems it actually has),
then designs a tailored set of investigation lenses from that profile — skipping
categories that don't apply, adding repo-specific ones that do. A static site generator
and a payments backend get meaningfully different lens sets.
This page lists the categories the lens-design step is instructed to consider (see the
exact prompt in
init-flow.md),
mapped against the OWASP Top 10:2025 as a shared
reference vocabulary. Treat the OWASP column as "the closest recognized category", not a
claim that every OWASP entry gets its own dedicated lens on every repo, or that this is
the full extent of what a lens might find — a lens's actual prompt is generated per-repo
and can go narrower or broader than the label below.
| 16 Eyes lens category (considered by lens design) | Closest OWASP Top 10:2025 category |
|---|---|
| Authentication & session management | A07:2025 — Authentication Failures |
| Authorization / access control (roles, tenant isolation, IDOR) | A01:2025 — Broken Access Control |
| Injection surfaces per data sink (SQL/NoSQL/command/template) | A05:2025 — Injection |
| Money movement / other irreversible actions (payments, deletions, sends) | A06:2025 — Insecure Design |
| Third-party webhook handlers (auth, replay, fail-open vs. fail-closed) | A01:2025 — Broken Access Control |
| File upload / import / parsing (arbitrary types, zip bombs, formula injection) | A05:2025 — Injection |
| LLM/AI usage (prompt injection, untrusted data reaching the model) | A06:2025 — Insecure Design |
| Frontend security (XSS, CSRF, secrets exposed in client bundle) | A05:2025 — Injection / A02:2025 — Security Misconfiguration |
| CI/CD supply chain (unpinned actions/deps, secret handling, token scope) | A03:2025 — Software Supply Chain Failures |
| Secrets & credentials management (hardcoded values, logging, rotation) | A02:2025 — Security Misconfiguration |
| Infra-as-config (deploy config, exposed admin surfaces, missing rate limits) | A02:2025 — Security Misconfiguration |
| Dependency vulnerabilities (only when there's a concrete signal) | A03:2025 — Software Supply Chain Failures |
| Business-logic-specific risks unique to the repo's actual domain | A06:2025 — Insecure Design |
- A04:2025 — Cryptographic Failures — surfaced only incidentally, when a lens's focus area happens to touch it (e.g. secrets management catching a weak hashing scheme). There's no lens whose entire focus is cryptographic implementation review.
- A08:2025 — Software or Data Integrity Failures — partially covered by the CI/CD supply-chain lens (unpinned actions, install-script risk) but not a full integrity-verification review (e.g. no dedicated check for unsigned deserialization or CI/CD pipeline integrity beyond what that lens's prompt covers).
-
A09:2025 — Security Logging and Alerting Failures — not a standing lens category;
would only surface if the repo profile's
risk_relevant_subsystemsstep flagged it as a repo-specific concern. - A10:2025 — Mishandling of Exceptional Conditions — same as above: no dedicated lens, only incidental coverage through whatever a repo-specific lens happens to touch.
If your repo has a strong reason to prioritize one of these, /16-eyes init can be
re-run and asked to add it explicitly, or /16-eyes audit --focus "<area>" can narrow an
existing run to whichever persisted lenses are relevant to a stated focus.
Because it's useful as shared vocabulary, not as a target to check off. A reader
evaluating this tool benefits from knowing which recognized categories it's designed to
reason about, even though the actual lens set for their specific repo is generated fresh
each time /16-eyes init runs, not read off this table.