Every endpoint your app exposes and every page your sign-in screen protects is checked against each other so nothing reachable without a login is missed. Any gap found is closed in the same pass, and the check becomes a script you can run again.
What ports as-is
- The full auth surface enumerated: fallback policy, exclusions, service key
- That surface joined against the client's own protected-resource map
- A caller-keyed rule for whether a surviving exclusion is safe
What we build for you
- The endpoint list and identity provider configuration
- The API-key scheme for machine callers
